2 * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
4 * PAPR Virtual SCSI, aka ibmvscsi
6 * Copyright (c) 2010,2011 Benjamin Herrenschmidt, IBM Corporation.
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
29 * - Sort out better how to assign devices to VSCSI instances
30 * - Fix residual counts
31 * - Add indirect descriptors support
32 * - Maybe do autosense (PAPR seems to mandate it, linux doesn't care)
35 #include "qemu/osdep.h"
36 #include "qemu/module.h"
38 #include "hw/scsi/scsi.h"
39 #include "migration/vmstate.h"
40 #include "scsi/constants.h"
42 #include "hw/ppc/spapr.h"
43 #include "hw/ppc/spapr_vio.h"
44 #include "hw/qdev-properties.h"
49 #include "qom/object.h"
56 #define VSCSI_MAX_SECTORS 4096
57 #define VSCSI_REQ_LIMIT 24
59 /* Maximum size of a IU payload */
60 #define SRP_MAX_IU_DATA_LEN (SRP_MAX_IU_LEN - sizeof(union srp_iu))
61 #define SRP_RSP_SENSE_DATA_LEN 18
63 #define SRP_REPORT_LUNS_WLUN 0xc10100000000000ULL
65 typedef union vscsi_crq
{
70 typedef struct vscsi_req
{
72 uint8_t viosrp_iu_buf
[SRP_MAX_IU_LEN
];
74 /* SCSI request tracking */
76 uint32_t qtag
; /* qemu tag != srp tag */
82 uint8_t sense
[SCSI_SENSE_BUF_SIZE
];
84 /* RDMA related bits */
89 uint16_t cur_desc_num
;
90 uint16_t cur_desc_offset
;
93 #define TYPE_VIO_SPAPR_VSCSI_DEVICE "spapr-vscsi"
94 typedef struct VSCSIState VSCSIState
;
95 #define VIO_SPAPR_VSCSI_DEVICE(obj) \
96 OBJECT_CHECK(VSCSIState, (obj), TYPE_VIO_SPAPR_VSCSI_DEVICE)
101 vscsi_req reqs
[VSCSI_REQ_LIMIT
];
104 static union viosrp_iu
*req_iu(vscsi_req
*req
)
106 return (union viosrp_iu
*)req
->viosrp_iu_buf
;
109 static struct vscsi_req
*vscsi_get_req(VSCSIState
*s
)
114 for (i
= 0; i
< VSCSI_REQ_LIMIT
; i
++) {
117 memset(req
, 0, sizeof(*req
));
126 static struct vscsi_req
*vscsi_find_req(VSCSIState
*s
, uint64_t srp_tag
)
131 for (i
= 0; i
< VSCSI_REQ_LIMIT
; i
++) {
133 if (req_iu(req
)->srp
.cmd
.tag
== srp_tag
) {
140 static void vscsi_put_req(vscsi_req
*req
)
142 if (req
->sreq
!= NULL
) {
143 scsi_req_unref(req
->sreq
);
149 static SCSIDevice
*vscsi_device_find(SCSIBus
*bus
, uint64_t srp_lun
, int *lun
)
151 int channel
= 0, id
= 0;
154 switch (srp_lun
>> 62) {
156 if ((srp_lun
>> 56) != 0) {
157 channel
= (srp_lun
>> 56) & 0x3f;
158 id
= (srp_lun
>> 48) & 0xff;
162 *lun
= (srp_lun
>> 48) & 0xff;
166 *lun
= (srp_lun
>> 48) & 0x3fff;
169 channel
= (srp_lun
>> 53) & 0x7;
170 id
= (srp_lun
>> 56) & 0x3f;
171 *lun
= (srp_lun
>> 48) & 0x1f;
180 return scsi_device_find(bus
, channel
, id
, *lun
);
183 static int vscsi_send_iu(VSCSIState
*s
, vscsi_req
*req
,
184 uint64_t length
, uint8_t format
)
188 assert(length
<= SRP_MAX_IU_LEN
);
190 /* First copy the SRP */
191 rc
= spapr_vio_dma_write(&s
->vdev
, req
->crq
.s
.IU_data_ptr
,
192 &req
->viosrp_iu_buf
, length
);
194 fprintf(stderr
, "vscsi_send_iu: DMA write failure !\n");
197 req
->crq
.s
.valid
= 0x80;
198 req
->crq
.s
.format
= format
;
199 req
->crq
.s
.reserved
= 0x00;
200 req
->crq
.s
.timeout
= cpu_to_be16(0x0000);
201 req
->crq
.s
.IU_length
= cpu_to_be16(length
);
202 req
->crq
.s
.IU_data_ptr
= req_iu(req
)->srp
.rsp
.tag
; /* right byte order */
205 req
->crq
.s
.status
= VIOSRP_OK
;
207 req
->crq
.s
.status
= VIOSRP_ADAPTER_FAIL
;
210 rc1
= spapr_vio_send_crq(&s
->vdev
, req
->crq
.raw
);
212 fprintf(stderr
, "vscsi_send_iu: Error sending response\n");
219 static void vscsi_makeup_sense(VSCSIState
*s
, vscsi_req
*req
,
220 uint8_t key
, uint8_t asc
, uint8_t ascq
)
222 req
->senselen
= SRP_RSP_SENSE_DATA_LEN
;
224 /* Valid bit and 'current errors' */
225 req
->sense
[0] = (0x1 << 7 | 0x70);
228 /* Additional sense length */
229 req
->sense
[7] = 0xa; /* 10 bytes */
230 /* Additional sense code */
231 req
->sense
[12] = asc
;
232 req
->sense
[13] = ascq
;
235 static int vscsi_send_rsp(VSCSIState
*s
, vscsi_req
*req
,
236 uint8_t status
, int32_t res_in
, int32_t res_out
)
238 union viosrp_iu
*iu
= req_iu(req
);
239 uint64_t tag
= iu
->srp
.rsp
.tag
;
240 int total_len
= sizeof(iu
->srp
.rsp
);
241 uint8_t sol_not
= iu
->srp
.cmd
.sol_not
;
243 trace_spapr_vscsi_send_rsp(status
, res_in
, res_out
);
245 memset(iu
, 0, sizeof(struct srp_rsp
));
246 iu
->srp
.rsp
.opcode
= SRP_RSP
;
247 iu
->srp
.rsp
.req_lim_delta
= cpu_to_be32(1);
248 iu
->srp
.rsp
.tag
= tag
;
250 /* Handle residuals */
252 iu
->srp
.rsp
.flags
|= SRP_RSP_FLAG_DIUNDER
;
255 iu
->srp
.rsp
.flags
|= SRP_RSP_FLAG_DIOVER
;
258 iu
->srp
.rsp
.flags
|= SRP_RSP_FLAG_DOUNDER
;
260 } else if (res_out
) {
261 iu
->srp
.rsp
.flags
|= SRP_RSP_FLAG_DOOVER
;
263 iu
->srp
.rsp
.data_in_res_cnt
= cpu_to_be32(res_in
);
264 iu
->srp
.rsp
.data_out_res_cnt
= cpu_to_be32(res_out
);
266 /* We don't do response data */
267 /* iu->srp.rsp.flags &= ~SRP_RSP_FLAG_RSPVALID; */
268 iu
->srp
.rsp
.resp_data_len
= cpu_to_be32(0);
270 /* Handle success vs. failure */
271 iu
->srp
.rsp
.status
= status
;
273 iu
->srp
.rsp
.sol_not
= (sol_not
& 0x04) >> 2;
275 int sense_data_len
= MIN(req
->senselen
, SRP_MAX_IU_DATA_LEN
);
277 iu
->srp
.rsp
.flags
|= SRP_RSP_FLAG_SNSVALID
;
278 iu
->srp
.rsp
.sense_data_len
= cpu_to_be32(sense_data_len
);
279 memcpy(iu
->srp
.rsp
.data
, req
->sense
, sense_data_len
);
280 total_len
+= sense_data_len
;
283 iu
->srp
.rsp
.sol_not
= (sol_not
& 0x02) >> 1;
286 vscsi_send_iu(s
, req
, total_len
, VIOSRP_SRP_FORMAT
);
290 static inline struct srp_direct_buf
vscsi_swap_desc(struct srp_direct_buf desc
)
292 desc
.va
= be64_to_cpu(desc
.va
);
293 desc
.len
= be32_to_cpu(desc
.len
);
297 static int vscsi_fetch_desc(VSCSIState
*s
, struct vscsi_req
*req
,
298 unsigned n
, unsigned buf_offset
,
299 struct srp_direct_buf
*ret
)
301 struct srp_cmd
*cmd
= &req_iu(req
)->srp
.cmd
;
303 switch (req
->dma_fmt
) {
304 case SRP_NO_DATA_DESC
: {
305 trace_spapr_vscsi_fetch_desc_no_data();
308 case SRP_DATA_DESC_DIRECT
: {
309 memcpy(ret
, cmd
->add_data
+ req
->cdb_offset
, sizeof(*ret
));
310 assert(req
->cur_desc_num
== 0);
311 trace_spapr_vscsi_fetch_desc_direct();
314 case SRP_DATA_DESC_INDIRECT
: {
315 struct srp_indirect_buf
*tmp
= (struct srp_indirect_buf
*)
316 (cmd
->add_data
+ req
->cdb_offset
);
317 if (n
< req
->local_desc
) {
318 *ret
= tmp
->desc_list
[n
];
319 trace_spapr_vscsi_fetch_desc_indirect(req
->qtag
, n
,
321 } else if (n
< req
->total_desc
) {
323 struct srp_direct_buf tbl_desc
= vscsi_swap_desc(tmp
->table_desc
);
324 unsigned desc_offset
= n
* sizeof(struct srp_direct_buf
);
326 if (desc_offset
>= tbl_desc
.len
) {
327 trace_spapr_vscsi_fetch_desc_out_of_range(n
, desc_offset
);
330 rc
= spapr_vio_dma_read(&s
->vdev
, tbl_desc
.va
+ desc_offset
,
331 ret
, sizeof(struct srp_direct_buf
));
333 trace_spapr_vscsi_fetch_desc_dma_read_error(rc
);
336 trace_spapr_vscsi_fetch_desc_indirect_seg_ext(req
->qtag
, n
,
341 trace_spapr_vscsi_fetch_desc_out_of_desc();
347 fprintf(stderr
, "VSCSI: Unknown format %x\n", req
->dma_fmt
);
351 *ret
= vscsi_swap_desc(*ret
);
352 if (buf_offset
> ret
->len
) {
353 trace_spapr_vscsi_fetch_desc_out_of_desc_boundary(buf_offset
,
358 ret
->va
+= buf_offset
;
359 ret
->len
-= buf_offset
;
361 trace_spapr_vscsi_fetch_desc_done(req
->cur_desc_num
, req
->cur_desc_offset
,
364 return ret
->len
? 1 : 0;
367 static int vscsi_srp_direct_data(VSCSIState
*s
, vscsi_req
*req
,
368 uint8_t *buf
, uint32_t len
)
370 struct srp_direct_buf md
;
374 rc
= vscsi_fetch_desc(s
, req
, req
->cur_desc_num
, req
->cur_desc_offset
, &md
);
377 } else if (rc
== 0) {
381 llen
= MIN(len
, md
.len
);
383 if (req
->writing
) { /* writing = to device = reading from memory */
384 rc
= spapr_vio_dma_read(&s
->vdev
, md
.va
, buf
, llen
);
386 rc
= spapr_vio_dma_write(&s
->vdev
, md
.va
, buf
, llen
);
393 req
->cur_desc_offset
+= llen
;
398 static int vscsi_srp_indirect_data(VSCSIState
*s
, vscsi_req
*req
,
399 uint8_t *buf
, uint32_t len
)
401 struct srp_direct_buf md
;
403 uint32_t llen
, total
= 0;
405 trace_spapr_vscsi_srp_indirect_data(len
);
407 /* While we have data ... */
409 rc
= vscsi_fetch_desc(s
, req
, req
->cur_desc_num
, req
->cur_desc_offset
, &md
);
412 } else if (rc
== 0) {
416 /* Perform transfer */
417 llen
= MIN(len
, md
.len
);
418 if (req
->writing
) { /* writing = to device = reading from memory */
419 rc
= spapr_vio_dma_read(&s
->vdev
, md
.va
, buf
, llen
);
421 rc
= spapr_vio_dma_write(&s
->vdev
, md
.va
, buf
, llen
);
424 trace_spapr_vscsi_srp_indirect_data_rw(req
->writing
, rc
);
427 trace_spapr_vscsi_srp_indirect_data_buf(buf
[0], buf
[1], buf
[2], buf
[3]);
434 /* Update current position in the current descriptor */
435 req
->cur_desc_offset
+= llen
;
436 if (md
.len
== llen
) {
437 /* Go to the next descriptor if the current one finished */
439 req
->cur_desc_offset
= 0;
443 return rc
? -1 : total
;
446 static int vscsi_srp_transfer_data(VSCSIState
*s
, vscsi_req
*req
,
447 int writing
, uint8_t *buf
, uint32_t len
)
451 switch (req
->dma_fmt
) {
452 case SRP_NO_DATA_DESC
:
453 trace_spapr_vscsi_srp_transfer_data(len
);
455 case SRP_DATA_DESC_DIRECT
:
456 err
= vscsi_srp_direct_data(s
, req
, buf
, len
);
458 case SRP_DATA_DESC_INDIRECT
:
459 err
= vscsi_srp_indirect_data(s
, req
, buf
, len
);
465 /* Bits from linux srp */
466 static int data_out_desc_size(struct srp_cmd
*cmd
)
469 uint8_t fmt
= cmd
->buf_fmt
>> 4;
472 case SRP_NO_DATA_DESC
:
474 case SRP_DATA_DESC_DIRECT
:
475 size
= sizeof(struct srp_direct_buf
);
477 case SRP_DATA_DESC_INDIRECT
:
478 size
= sizeof(struct srp_indirect_buf
) +
479 sizeof(struct srp_direct_buf
)*cmd
->data_out_desc_cnt
;
487 static int vscsi_preprocess_desc(vscsi_req
*req
)
489 struct srp_cmd
*cmd
= &req_iu(req
)->srp
.cmd
;
491 req
->cdb_offset
= cmd
->add_cdb_len
& ~3;
494 req
->dma_fmt
= cmd
->buf_fmt
>> 4;
496 req
->cdb_offset
+= data_out_desc_size(cmd
);
497 req
->dma_fmt
= cmd
->buf_fmt
& ((1U << 4) - 1);
500 switch (req
->dma_fmt
) {
501 case SRP_NO_DATA_DESC
:
503 case SRP_DATA_DESC_DIRECT
:
504 req
->total_desc
= req
->local_desc
= 1;
506 case SRP_DATA_DESC_INDIRECT
: {
507 struct srp_indirect_buf
*ind_tmp
= (struct srp_indirect_buf
*)
508 (cmd
->add_data
+ req
->cdb_offset
);
510 req
->total_desc
= be32_to_cpu(ind_tmp
->table_desc
.len
) /
511 sizeof(struct srp_direct_buf
);
512 req
->local_desc
= req
->writing
? cmd
->data_out_desc_cnt
:
513 cmd
->data_in_desc_cnt
;
518 "vscsi_preprocess_desc: Unknown format %x\n", req
->dma_fmt
);
525 /* Callback to indicate that the SCSI layer has completed a transfer. */
526 static void vscsi_transfer_data(SCSIRequest
*sreq
, uint32_t len
)
528 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(sreq
->bus
->qbus
.parent
);
529 vscsi_req
*req
= sreq
->hba_private
;
533 trace_spapr_vscsi_transfer_data(sreq
->tag
, len
, req
);
535 fprintf(stderr
, "VSCSI: Can't find request for tag 0x%x\n", sreq
->tag
);
540 buf
= scsi_req_get_buf(sreq
);
541 rc
= vscsi_srp_transfer_data(s
, req
, req
->writing
, buf
, len
);
544 fprintf(stderr
, "VSCSI: RDMA error rc=%d!\n", rc
);
545 req
->dma_error
= true;
546 scsi_req_cancel(req
->sreq
);
550 /* Start next chunk */
552 scsi_req_continue(sreq
);
555 /* Callback to indicate that the SCSI layer has completed a transfer. */
556 static void vscsi_command_complete(SCSIRequest
*sreq
, uint32_t status
, size_t resid
)
558 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(sreq
->bus
->qbus
.parent
);
559 vscsi_req
*req
= sreq
->hba_private
;
560 int32_t res_in
= 0, res_out
= 0;
562 trace_spapr_vscsi_command_complete(sreq
->tag
, status
, req
);
564 fprintf(stderr
, "VSCSI: Can't find request for tag 0x%x\n", sreq
->tag
);
568 if (status
== CHECK_CONDITION
) {
569 req
->senselen
= scsi_req_get_sense(req
->sreq
, req
->sense
,
571 trace_spapr_vscsi_command_complete_sense_data1(req
->senselen
,
572 req
->sense
[0], req
->sense
[1], req
->sense
[2], req
->sense
[3],
573 req
->sense
[4], req
->sense
[5], req
->sense
[6], req
->sense
[7]);
574 trace_spapr_vscsi_command_complete_sense_data2(
575 req
->sense
[8], req
->sense
[9], req
->sense
[10], req
->sense
[11],
576 req
->sense
[12], req
->sense
[13], req
->sense
[14], req
->sense
[15]);
579 trace_spapr_vscsi_command_complete_status(status
);
581 /* We handle overflows, not underflows for normal commands,
582 * but hopefully nobody cares
585 res_out
= req
->data_len
;
587 res_in
= req
->data_len
;
590 vscsi_send_rsp(s
, req
, status
, res_in
, res_out
);
594 static void vscsi_request_cancelled(SCSIRequest
*sreq
)
596 vscsi_req
*req
= sreq
->hba_private
;
598 if (req
->dma_error
) {
599 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(sreq
->bus
->qbus
.parent
);
601 vscsi_makeup_sense(s
, req
, HARDWARE_ERROR
, 0, 0);
602 vscsi_send_rsp(s
, req
, CHECK_CONDITION
, 0, 0);
607 static const VMStateDescription vmstate_spapr_vscsi_req
= {
608 .name
= "spapr_vscsi_req",
610 .minimum_version_id
= 1,
611 .fields
= (VMStateField
[]) {
612 VMSTATE_BUFFER(crq
.raw
, vscsi_req
),
613 VMSTATE_BUFFER(viosrp_iu_buf
, vscsi_req
),
614 VMSTATE_UINT32(qtag
, vscsi_req
),
615 VMSTATE_BOOL(active
, vscsi_req
),
616 VMSTATE_UINT32(data_len
, vscsi_req
),
617 VMSTATE_BOOL(writing
, vscsi_req
),
618 VMSTATE_UINT32(senselen
, vscsi_req
),
619 VMSTATE_BUFFER(sense
, vscsi_req
),
620 VMSTATE_UINT8(dma_fmt
, vscsi_req
),
621 VMSTATE_UINT16(local_desc
, vscsi_req
),
622 VMSTATE_UINT16(total_desc
, vscsi_req
),
623 VMSTATE_UINT16(cdb_offset
, vscsi_req
),
624 /*Restart SCSI request from the beginning for now */
625 /*VMSTATE_UINT16(cur_desc_num, vscsi_req),
626 VMSTATE_UINT16(cur_desc_offset, vscsi_req),*/
627 VMSTATE_END_OF_LIST()
631 static void vscsi_save_request(QEMUFile
*f
, SCSIRequest
*sreq
)
633 vscsi_req
*req
= sreq
->hba_private
;
636 vmstate_save_state(f
, &vmstate_spapr_vscsi_req
, req
, NULL
);
638 trace_spapr_vscsi_save_request(req
->qtag
, req
->cur_desc_num
,
639 req
->cur_desc_offset
);
642 static void *vscsi_load_request(QEMUFile
*f
, SCSIRequest
*sreq
)
644 SCSIBus
*bus
= sreq
->bus
;
645 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(bus
->qbus
.parent
);
649 assert(sreq
->tag
< VSCSI_REQ_LIMIT
);
650 req
= &s
->reqs
[sreq
->tag
];
651 assert(!req
->active
);
653 memset(req
, 0, sizeof(*req
));
654 rc
= vmstate_load_state(f
, &vmstate_spapr_vscsi_req
, req
, 1);
656 fprintf(stderr
, "VSCSI: failed loading request tag#%u\n", sreq
->tag
);
661 req
->sreq
= scsi_req_ref(sreq
);
663 trace_spapr_vscsi_load_request(req
->qtag
, req
->cur_desc_num
,
664 req
->cur_desc_offset
);
669 static void vscsi_process_login(VSCSIState
*s
, vscsi_req
*req
)
671 union viosrp_iu
*iu
= req_iu(req
);
672 struct srp_login_rsp
*rsp
= &iu
->srp
.login_rsp
;
673 uint64_t tag
= iu
->srp
.rsp
.tag
;
675 trace_spapr_vscsi_process_login();
677 /* TODO handle case that requested size is wrong and
678 * buffer format is wrong
680 memset(iu
, 0, sizeof(struct srp_login_rsp
));
681 rsp
->opcode
= SRP_LOGIN_RSP
;
682 /* Don't advertise quite as many request as we support to
683 * keep room for management stuff etc...
685 rsp
->req_lim_delta
= cpu_to_be32(VSCSI_REQ_LIMIT
-2);
687 rsp
->max_it_iu_len
= cpu_to_be32(SRP_MAX_IU_LEN
);
688 rsp
->max_ti_iu_len
= cpu_to_be32(SRP_MAX_IU_LEN
);
689 /* direct and indirect */
690 rsp
->buf_fmt
= cpu_to_be16(SRP_BUF_FORMAT_DIRECT
| SRP_BUF_FORMAT_INDIRECT
);
692 vscsi_send_iu(s
, req
, sizeof(*rsp
), VIOSRP_SRP_FORMAT
);
695 static void vscsi_inquiry_no_target(VSCSIState
*s
, vscsi_req
*req
)
697 uint8_t *cdb
= req_iu(req
)->srp
.cmd
.cdb
;
698 uint8_t resp_data
[36];
701 /* We don't do EVPD. Also check that page_code is 0 */
702 if ((cdb
[1] & 0x01) || cdb
[2] != 0) {
703 /* Send INVALID FIELD IN CDB */
704 vscsi_makeup_sense(s
, req
, ILLEGAL_REQUEST
, 0x24, 0);
705 vscsi_send_rsp(s
, req
, CHECK_CONDITION
, 0, 0);
709 alen
= (alen
<< 8) | cdb
[4];
712 /* Fake up inquiry using PQ=3 */
713 memset(resp_data
, 0, 36);
714 resp_data
[0] = 0x7f; /* Not capable of supporting a device here */
715 resp_data
[2] = 0x06; /* SPS-4 */
716 resp_data
[3] = 0x02; /* Resp data format */
717 resp_data
[4] = 36 - 5; /* Additional length */
718 resp_data
[7] = 0x10; /* Sync transfers */
719 memcpy(&resp_data
[16], "QEMU EMPTY ", 16);
720 memcpy(&resp_data
[8], "QEMU ", 8);
723 vscsi_preprocess_desc(req
);
724 rc
= vscsi_srp_transfer_data(s
, req
, 0, resp_data
, len
);
726 vscsi_makeup_sense(s
, req
, HARDWARE_ERROR
, 0, 0);
727 vscsi_send_rsp(s
, req
, CHECK_CONDITION
, 0, 0);
729 vscsi_send_rsp(s
, req
, 0, 36 - rc
, 0);
733 static void vscsi_report_luns(VSCSIState
*s
, vscsi_req
*req
)
742 QTAILQ_FOREACH(kid
, &s
->bus
.qbus
.children
, sibling
) {
743 SCSIDevice
*dev
= SCSI_DEVICE(kid
->child
);
746 if (dev
->channel
== 0 && dev
->id
== 0 && dev
->lun
== 0) {
755 resp_data
= g_malloc0(len
);
756 stl_be_p(resp_data
, n
);
757 i
= found_lun0
? 8 : 16;
758 QTAILQ_FOREACH(kid
, &s
->bus
.qbus
.children
, sibling
) {
759 DeviceState
*qdev
= kid
->child
;
760 SCSIDevice
*dev
= SCSI_DEVICE(qdev
);
762 if (dev
->id
== 0 && dev
->channel
== 0) {
763 resp_data
[i
] = 0; /* Use simple LUN for 0 (SAM5 4.7.7.1) */
765 resp_data
[i
] = (2 << 6); /* Otherwise LUN addressing (4.7.7.4) */
767 resp_data
[i
] |= dev
->id
;
768 resp_data
[i
+1] = (dev
->channel
<< 5);
769 resp_data
[i
+1] |= dev
->lun
;
773 vscsi_preprocess_desc(req
);
774 rc
= vscsi_srp_transfer_data(s
, req
, 0, resp_data
, len
);
777 vscsi_makeup_sense(s
, req
, HARDWARE_ERROR
, 0, 0);
778 vscsi_send_rsp(s
, req
, CHECK_CONDITION
, 0, 0);
780 vscsi_send_rsp(s
, req
, 0, len
- rc
, 0);
784 static int vscsi_queue_cmd(VSCSIState
*s
, vscsi_req
*req
)
786 union srp_iu
*srp
= &req_iu(req
)->srp
;
790 if ((srp
->cmd
.lun
== 0 || be64_to_cpu(srp
->cmd
.lun
) == SRP_REPORT_LUNS_WLUN
)
791 && srp
->cmd
.cdb
[0] == REPORT_LUNS
) {
792 vscsi_report_luns(s
, req
);
796 sdev
= vscsi_device_find(&s
->bus
, be64_to_cpu(srp
->cmd
.lun
), &lun
);
798 trace_spapr_vscsi_queue_cmd_no_drive(be64_to_cpu(srp
->cmd
.lun
));
799 if (srp
->cmd
.cdb
[0] == INQUIRY
) {
800 vscsi_inquiry_no_target(s
, req
);
802 vscsi_makeup_sense(s
, req
, ILLEGAL_REQUEST
, 0x24, 0x00);
803 vscsi_send_rsp(s
, req
, CHECK_CONDITION
, 0, 0);
807 req
->sreq
= scsi_req_new(sdev
, req
->qtag
, lun
, srp
->cmd
.cdb
, req
);
808 n
= scsi_req_enqueue(req
->sreq
);
810 trace_spapr_vscsi_queue_cmd(req
->qtag
, srp
->cmd
.cdb
[0],
811 scsi_command_name(srp
->cmd
.cdb
[0]), lun
, n
);
814 /* Transfer direction must be set before preprocessing the
817 req
->writing
= (n
< 1);
819 /* Preprocess RDMA descriptors */
820 vscsi_preprocess_desc(req
);
822 /* Get transfer direction and initiate transfer */
828 scsi_req_continue(req
->sreq
);
830 /* Don't touch req here, it may have been recycled already */
835 static int vscsi_process_tsk_mgmt(VSCSIState
*s
, vscsi_req
*req
)
837 union viosrp_iu
*iu
= req_iu(req
);
839 int i
, lun
= 0, resp
= SRP_TSK_MGMT_COMPLETE
;
841 uint64_t tag
= iu
->srp
.rsp
.tag
;
842 uint8_t sol_not
= iu
->srp
.cmd
.sol_not
;
844 trace_spapr_vscsi_process_tsk_mgmt(iu
->srp
.tsk_mgmt
.tsk_mgmt_func
);
845 d
= vscsi_device_find(&s
->bus
,
846 be64_to_cpu(req_iu(req
)->srp
.tsk_mgmt
.lun
), &lun
);
848 resp
= SRP_TSK_MGMT_FIELDS_INVALID
;
850 switch (iu
->srp
.tsk_mgmt
.tsk_mgmt_func
) {
851 case SRP_TSK_ABORT_TASK
:
853 resp
= SRP_TSK_MGMT_FIELDS_INVALID
;
857 tmpreq
= vscsi_find_req(s
, req_iu(req
)->srp
.tsk_mgmt
.task_tag
);
858 if (tmpreq
&& tmpreq
->sreq
) {
859 assert(tmpreq
->sreq
->hba_private
);
860 scsi_req_cancel(tmpreq
->sreq
);
864 case SRP_TSK_LUN_RESET
:
866 resp
= SRP_TSK_MGMT_FIELDS_INVALID
;
870 qdev_reset_all(&d
->qdev
);
873 case SRP_TSK_ABORT_TASK_SET
:
874 case SRP_TSK_CLEAR_TASK_SET
:
876 resp
= SRP_TSK_MGMT_FIELDS_INVALID
;
880 for (i
= 0; i
< VSCSI_REQ_LIMIT
; i
++) {
881 tmpreq
= &s
->reqs
[i
];
882 if (req_iu(tmpreq
)->srp
.cmd
.lun
883 != req_iu(req
)->srp
.tsk_mgmt
.lun
) {
886 if (!tmpreq
->active
|| !tmpreq
->sreq
) {
889 assert(tmpreq
->sreq
->hba_private
);
890 scsi_req_cancel(tmpreq
->sreq
);
894 case SRP_TSK_CLEAR_ACA
:
895 resp
= SRP_TSK_MGMT_NOT_SUPPORTED
;
899 resp
= SRP_TSK_MGMT_FIELDS_INVALID
;
904 /* Compose the response here as */
905 QEMU_BUILD_BUG_ON(SRP_MAX_IU_DATA_LEN
< 4);
906 memset(iu
, 0, sizeof(struct srp_rsp
) + 4);
907 iu
->srp
.rsp
.opcode
= SRP_RSP
;
908 iu
->srp
.rsp
.req_lim_delta
= cpu_to_be32(1);
909 iu
->srp
.rsp
.tag
= tag
;
910 iu
->srp
.rsp
.flags
|= SRP_RSP_FLAG_RSPVALID
;
911 iu
->srp
.rsp
.resp_data_len
= cpu_to_be32(4);
913 iu
->srp
.rsp
.sol_not
= (sol_not
& 0x04) >> 2;
915 iu
->srp
.rsp
.sol_not
= (sol_not
& 0x02) >> 1;
918 iu
->srp
.rsp
.status
= GOOD
;
919 iu
->srp
.rsp
.data
[3] = resp
;
921 vscsi_send_iu(s
, req
, sizeof(iu
->srp
.rsp
) + 4, VIOSRP_SRP_FORMAT
);
926 static int vscsi_handle_srp_req(VSCSIState
*s
, vscsi_req
*req
)
928 union srp_iu
*srp
= &req_iu(req
)->srp
;
930 uint8_t opcode
= srp
->rsp
.opcode
;
934 vscsi_process_login(s
, req
);
937 done
= vscsi_process_tsk_mgmt(s
, req
);
940 done
= vscsi_queue_cmd(s
, req
);
950 fprintf(stderr
, "VSCSI: Unsupported opcode %02x\n", opcode
);
953 fprintf(stderr
, "VSCSI: Unknown type %02x\n", opcode
);
959 static int vscsi_send_adapter_info(VSCSIState
*s
, vscsi_req
*req
)
961 struct viosrp_adapter_info
*sinfo
;
962 struct mad_adapter_info_data info
;
965 sinfo
= &req_iu(req
)->mad
.adapter_info
;
967 #if 0 /* What for ? */
968 rc
= spapr_vio_dma_read(&s
->vdev
, be64_to_cpu(sinfo
->buffer
),
969 &info
, be16_to_cpu(sinfo
->common
.length
));
971 fprintf(stderr
, "vscsi_send_adapter_info: DMA read failure !\n");
974 memset(&info
, 0, sizeof(info
));
975 strcpy(info
.srp_version
, SRP_VERSION
);
976 memcpy(info
.partition_name
, "qemu", sizeof("qemu"));
977 info
.partition_number
= cpu_to_be32(0);
978 info
.mad_version
= cpu_to_be32(1);
979 info
.os_type
= cpu_to_be32(2);
980 info
.port_max_txu
[0] = cpu_to_be32(VSCSI_MAX_SECTORS
<< 9);
982 rc
= spapr_vio_dma_write(&s
->vdev
, be64_to_cpu(sinfo
->buffer
),
983 &info
, be16_to_cpu(sinfo
->common
.length
));
985 fprintf(stderr
, "vscsi_send_adapter_info: DMA write failure !\n");
988 sinfo
->common
.status
= rc
? cpu_to_be32(1) : 0;
990 return vscsi_send_iu(s
, req
, sizeof(*sinfo
), VIOSRP_MAD_FORMAT
);
993 static int vscsi_send_capabilities(VSCSIState
*s
, vscsi_req
*req
)
995 struct viosrp_capabilities
*vcap
;
996 struct capabilities cap
= { };
997 uint16_t len
, req_len
;
1001 vcap
= &req_iu(req
)->mad
.capabilities
;
1002 req_len
= len
= be16_to_cpu(vcap
->common
.length
);
1003 buffer
= be64_to_cpu(vcap
->buffer
);
1004 if (len
> sizeof(cap
)) {
1005 fprintf(stderr
, "vscsi_send_capabilities: capabilities size mismatch !\n");
1008 * Just read and populate the structure that is known.
1009 * Zero rest of the structure.
1013 rc
= spapr_vio_dma_read(&s
->vdev
, buffer
, &cap
, len
);
1015 fprintf(stderr
, "vscsi_send_capabilities: DMA read failure !\n");
1019 * Current implementation does not suppport any migration or
1020 * reservation capabilities. Construct the response telling the
1021 * guest not to use them.
1024 cap
.migration
.ecl
= 0;
1025 cap
.reserve
.type
= 0;
1026 cap
.migration
.common
.server_support
= 0;
1027 cap
.reserve
.common
.server_support
= 0;
1029 rc
= spapr_vio_dma_write(&s
->vdev
, buffer
, &cap
, len
);
1031 fprintf(stderr
, "vscsi_send_capabilities: DMA write failure !\n");
1033 if (req_len
> len
) {
1035 * Being paranoid and lets not worry about the error code
1036 * here. Actual write of the cap is done above.
1038 spapr_vio_dma_set(&s
->vdev
, (buffer
+ len
), 0, (req_len
- len
));
1040 vcap
->common
.status
= rc
? cpu_to_be32(1) : 0;
1041 return vscsi_send_iu(s
, req
, sizeof(*vcap
), VIOSRP_MAD_FORMAT
);
1044 static int vscsi_handle_mad_req(VSCSIState
*s
, vscsi_req
*req
)
1046 union mad_iu
*mad
= &req_iu(req
)->mad
;
1047 bool request_handled
= false;
1048 uint64_t retlen
= 0;
1050 switch (be32_to_cpu(mad
->empty_iu
.common
.type
)) {
1051 case VIOSRP_EMPTY_IU_TYPE
:
1052 fprintf(stderr
, "Unsupported EMPTY MAD IU\n");
1053 retlen
= sizeof(mad
->empty_iu
);
1055 case VIOSRP_ERROR_LOG_TYPE
:
1056 fprintf(stderr
, "Unsupported ERROR LOG MAD IU\n");
1057 retlen
= sizeof(mad
->error_log
);
1059 case VIOSRP_ADAPTER_INFO_TYPE
:
1060 vscsi_send_adapter_info(s
, req
);
1061 request_handled
= true;
1063 case VIOSRP_HOST_CONFIG_TYPE
:
1064 retlen
= sizeof(mad
->host_config
);
1066 case VIOSRP_CAPABILITIES_TYPE
:
1067 vscsi_send_capabilities(s
, req
);
1068 request_handled
= true;
1071 fprintf(stderr
, "VSCSI: Unknown MAD type %02x\n",
1072 be32_to_cpu(mad
->empty_iu
.common
.type
));
1074 * PAPR+ says that "The length field is set to the length
1075 * of the data structure(s) used in the command".
1076 * As we did not recognize the request type, put zero there.
1081 if (!request_handled
) {
1082 mad
->empty_iu
.common
.status
= cpu_to_be16(VIOSRP_MAD_NOT_SUPPORTED
);
1083 vscsi_send_iu(s
, req
, retlen
, VIOSRP_MAD_FORMAT
);
1089 static void vscsi_got_payload(VSCSIState
*s
, vscsi_crq
*crq
)
1094 req
= vscsi_get_req(s
);
1096 fprintf(stderr
, "VSCSI: Failed to get a request !\n");
1100 /* We only support a limited number of descriptors, we know
1101 * the ibmvscsi driver uses up to 10 max, so it should fit
1102 * in our 256 bytes IUs. If not we'll have to increase the size
1105 if (crq
->s
.IU_length
> SRP_MAX_IU_LEN
) {
1106 fprintf(stderr
, "VSCSI: SRP IU too long (%d bytes) !\n",
1112 /* XXX Handle failure differently ? */
1113 if (spapr_vio_dma_read(&s
->vdev
, crq
->s
.IU_data_ptr
, &req
->viosrp_iu_buf
,
1114 crq
->s
.IU_length
)) {
1115 fprintf(stderr
, "vscsi_got_payload: DMA read failure !\n");
1119 memcpy(&req
->crq
, crq
, sizeof(vscsi_crq
));
1121 if (crq
->s
.format
== VIOSRP_MAD_FORMAT
) {
1122 done
= vscsi_handle_mad_req(s
, req
);
1124 done
= vscsi_handle_srp_req(s
, req
);
1133 static int vscsi_do_crq(struct SpaprVioDevice
*dev
, uint8_t *crq_data
)
1135 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(dev
);
1138 memcpy(crq
.raw
, crq_data
, 16);
1139 crq
.s
.timeout
= be16_to_cpu(crq
.s
.timeout
);
1140 crq
.s
.IU_length
= be16_to_cpu(crq
.s
.IU_length
);
1141 crq
.s
.IU_data_ptr
= be64_to_cpu(crq
.s
.IU_data_ptr
);
1143 trace_spapr_vscsi_do_crq(crq
.raw
[0], crq
.raw
[1]);
1145 switch (crq
.s
.valid
) {
1146 case 0xc0: /* Init command/response */
1148 /* Respond to initialization request */
1149 if (crq
.s
.format
== 0x01) {
1150 memset(crq
.raw
, 0, 16);
1152 crq
.s
.format
= 0x02;
1153 spapr_vio_send_crq(dev
, crq
.raw
);
1156 /* Note that in hotplug cases, we might get a 0x02
1157 * as a result of us emitting the init request
1161 case 0xff: /* Link event */
1163 /* Not handled for now */
1166 case 0x80: /* Payloads */
1167 switch (crq
.s
.format
) {
1168 case VIOSRP_SRP_FORMAT
: /* AKA VSCSI request */
1169 case VIOSRP_MAD_FORMAT
: /* AKA VSCSI response */
1170 vscsi_got_payload(s
, &crq
);
1172 case VIOSRP_OS400_FORMAT
:
1173 case VIOSRP_AIX_FORMAT
:
1174 case VIOSRP_LINUX_FORMAT
:
1175 case VIOSRP_INLINE_FORMAT
:
1176 fprintf(stderr
, "vscsi_do_srq: Unsupported payload format %02x\n",
1180 fprintf(stderr
, "vscsi_do_srq: Unknown payload format %02x\n",
1185 fprintf(stderr
, "vscsi_do_crq: unknown CRQ %02x %02x ...\n",
1186 crq
.raw
[0], crq
.raw
[1]);
1192 static const struct SCSIBusInfo vscsi_scsi_info
= {
1194 .max_channel
= 7, /* logical unit addressing format */
1198 .transfer_data
= vscsi_transfer_data
,
1199 .complete
= vscsi_command_complete
,
1200 .cancel
= vscsi_request_cancelled
,
1201 .save_request
= vscsi_save_request
,
1202 .load_request
= vscsi_load_request
,
1205 static void spapr_vscsi_reset(SpaprVioDevice
*dev
)
1207 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(dev
);
1210 memset(s
->reqs
, 0, sizeof(s
->reqs
));
1211 for (i
= 0; i
< VSCSI_REQ_LIMIT
; i
++) {
1212 s
->reqs
[i
].qtag
= i
;
1216 static void spapr_vscsi_realize(SpaprVioDevice
*dev
, Error
**errp
)
1218 VSCSIState
*s
= VIO_SPAPR_VSCSI_DEVICE(dev
);
1220 dev
->crq
.SendFunc
= vscsi_do_crq
;
1222 scsi_bus_new(&s
->bus
, sizeof(s
->bus
), DEVICE(dev
),
1223 &vscsi_scsi_info
, NULL
);
1225 /* ibmvscsi SCSI bus does not allow hotplug. */
1226 qbus_set_hotplug_handler(BUS(&s
->bus
), NULL
);
1229 void spapr_vscsi_create(SpaprVioBus
*bus
)
1233 dev
= qdev_new("spapr-vscsi");
1235 qdev_realize_and_unref(dev
, &bus
->bus
, &error_fatal
);
1236 scsi_bus_legacy_handle_cmdline(&VIO_SPAPR_VSCSI_DEVICE(dev
)->bus
);
1239 static int spapr_vscsi_devnode(SpaprVioDevice
*dev
, void *fdt
, int node_off
)
1243 ret
= fdt_setprop_cell(fdt
, node_off
, "#address-cells", 2);
1248 ret
= fdt_setprop_cell(fdt
, node_off
, "#size-cells", 0);
1256 static Property spapr_vscsi_properties
[] = {
1257 DEFINE_SPAPR_PROPERTIES(VSCSIState
, vdev
),
1258 DEFINE_PROP_END_OF_LIST(),
1261 static const VMStateDescription vmstate_spapr_vscsi
= {
1262 .name
= "spapr_vscsi",
1264 .minimum_version_id
= 1,
1265 .fields
= (VMStateField
[]) {
1266 VMSTATE_SPAPR_VIO(vdev
, VSCSIState
),
1270 VMSTATE_END_OF_LIST()
1274 static void spapr_vscsi_class_init(ObjectClass
*klass
, void *data
)
1276 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1277 SpaprVioDeviceClass
*k
= VIO_SPAPR_DEVICE_CLASS(klass
);
1279 k
->realize
= spapr_vscsi_realize
;
1280 k
->reset
= spapr_vscsi_reset
;
1281 k
->devnode
= spapr_vscsi_devnode
;
1282 k
->dt_name
= "v-scsi";
1283 k
->dt_type
= "vscsi";
1284 k
->dt_compatible
= "IBM,v-scsi";
1285 k
->signal_mask
= 0x00000001;
1286 set_bit(DEVICE_CATEGORY_STORAGE
, dc
->categories
);
1287 device_class_set_props(dc
, spapr_vscsi_properties
);
1288 k
->rtce_window_size
= 0x10000000;
1289 dc
->vmsd
= &vmstate_spapr_vscsi
;
1292 static const TypeInfo spapr_vscsi_info
= {
1293 .name
= TYPE_VIO_SPAPR_VSCSI_DEVICE
,
1294 .parent
= TYPE_VIO_SPAPR_DEVICE
,
1295 .instance_size
= sizeof(VSCSIState
),
1296 .class_init
= spapr_vscsi_class_init
,
1299 static void spapr_vscsi_register_types(void)
1301 type_register_static(&spapr_vscsi_info
);
1304 type_init(spapr_vscsi_register_types
)