On Fri, Jun 19, 2023, Stefan Hajnoczi wrote: >On Fri, Jun 16, 2023 at 03:58:27PM +0900, Jeuk Kim wrote: >> This commit adds support for ufs logical unit. >> The LU handles processing for the SCSI command, >> unit descriptor query request. >> >> This commit enables the UFS device to process >> IO requests. > >Is UFS a SCSI Host Bus Adapter capable of exposing any SCSI device? The >code is written as if UFS was a special-purpose SCSI bus that cannot >handle regular SCSI devices already emulated by QEMU (like scsi-hd). As >a result, it duplicates a lot of SCSI device code instead of just >focussing on unwrapping/wrapping the SCSI commands and responses from >the UFS interface. > >Would it be possible to have: > > --device ufs,id=<bus-name> > --device scsi-hd,bus=<bus-name> > >? > >I think that would involve less code and be more flexible. >
Unfortunately, UFS is not a generic SCSI Host Bus Adapter. UFS uses the SCSI specification to communicate with the driver, but its behaviour is very different from that of a typical SCSI device. (So it's intentional that UFS looks like a special-purpose SCSI bus.) For example, UFS has the well-known lu. Unlike typical SCSI devices, where each lu is independent, UFS can control other lu's through the well-known lu. Therefore, UFS can only work properly with ufs-lu, and not with other scsi devices such as scsi-hd. :'( That's why I made the UFS bus and added the ufs_bus_check_address() to prevent normal scsi devices and UFS from connecting to each other. Also, in the future, I will add more ufs-specific features like hibernation and zoned, which are different from normal SCSI devices. So personally, I think we should define ufs-lu separately as we do now. Is that okay? >> >> Signed-off-by: Jeuk Kim <[email protected]> >> --- >> hw/ufs/lu.c | 1441 ++++++++++++++++++++++++++++++++++++++ >> hw/ufs/meson.build | 2 +- >> hw/ufs/trace-events | 25 + >> hw/ufs/ufs.c | 252 ++++++- >> hw/ufs/ufs.h | 43 ++ >> include/scsi/constants.h | 1 + >> 6 files changed, 1757 insertions(+), 7 deletions(-) >> create mode 100644 hw/ufs/lu.c >> >> diff --git a/hw/ufs/lu.c b/hw/ufs/lu.c >> new file mode 100644 >> index 0000000000..ef69de61a5 >> --- /dev/null >> +++ b/hw/ufs/lu.c >> @@ -0,0 +1,1441 @@ >> +/* >> + * QEMU UFS Logical Unit >> + * >> + * Copyright (c) 2023 Samsung Electronics Co., Ltd. All rights reserved. >> + * >> + * Written by Jeuk Kim <[email protected]> >> + * >> + * This code is licensed under the GNU GPL v2 or later. >> + */ >> + >> +#include "qemu/osdep.h" >> +#include "qemu/units.h" >> +#include "qapi/error.h" >> +#include "qemu/memalign.h" >> +#include "hw/scsi/scsi.h" >> +#include "scsi/constants.h" >> +#include "sysemu/block-backend.h" >> +#include "qemu/cutils.h" >> +#include "trace.h" >> +#include "ufs.h" >> + >> +/* >> + * The code below handling SCSI commands is copied from hw/scsi/scsi-disk.c, >> + * with minor adjustments to make it work for UFS. >> + */ >> + >> +#define SCSI_DMA_BUF_SIZE (128 * KiB) >> +#define SCSI_MAX_INQUIRY_LEN 256 >> +#define SCSI_INQUIRY_DATA_SIZE 36 >> +#define SCSI_MAX_MODE_LEN 256 >> + >> +typedef struct UfsSCSIReq { >> + SCSIRequest req; >> + /* Both sector and sector_count are in terms of BDRV_SECTOR_SIZE bytes. >> */ >> + uint64_t sector; >> + uint32_t sector_count; >> + uint32_t buflen; >> + bool started; >> + bool need_fua_emulation; >> + struct iovec iov; >> + QEMUIOVector qiov; >> + BlockAcctCookie acct; >> +} UfsSCSIReq; >> + >> +static void ufs_scsi_free_request(SCSIRequest *req) >> +{ >> + UfsSCSIReq *r = DO_UPCAST(UfsSCSIReq, req, req); >> + >> + qemu_vfree(r->iov.iov_base); >> +} >> + >> +static void scsi_check_condition(UfsSCSIReq *r, SCSISense sense) >> +{ >> + trace_ufs_scsi_check_condition(r->req.tag, sense.key, sense.asc, >> + sense.ascq); >> + scsi_req_build_sense(&r->req, sense); >> + scsi_req_complete(&r->req, CHECK_CONDITION); >> +} >> + >> +static int ufs_scsi_emulate_vpd_page(SCSIRequest *req, uint8_t *outbuf, >> + uint32_t outbuf_len) >> +{ >> + UfsHc *u = UFS(req->bus->qbus.parent); >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, req->dev); >> + uint8_t page_code = req->cmd.buf[2]; >> + int start, buflen = 0; >> + >> + if (outbuf_len < SCSI_INQUIRY_DATA_SIZE) { >> + return -1; >> + } >> + >> + outbuf[buflen++] = lu->qdev.type & 0x1f; >> + outbuf[buflen++] = page_code; >> + outbuf[buflen++] = 0x00; >> + outbuf[buflen++] = 0x00; >> + start = buflen; >> + >> + switch (page_code) { >> + case 0x00: /* Supported page codes, mandatory */ >> + { >> + trace_ufs_scsi_emulate_vpd_page_00(req->cmd.xfer); >> + outbuf[buflen++] = 0x00; /* list of supported pages (this page) */ >> + if (u->params.serial) { >> + outbuf[buflen++] = 0x80; /* unit serial number */ >> + } >> + outbuf[buflen++] = 0x87; /* mode page policy */ >> + break; >> + } >> + case 0x80: /* Device serial number, optional */ >> + { >> + int l; >> + >> + if (!u->params.serial) { >> + trace_ufs_scsi_emulate_vpd_page_80_not_supported(); >> + return -1; >> + } >> + >> + l = strlen(u->params.serial); >> + if (l > SCSI_INQUIRY_DATA_SIZE) { >> + l = SCSI_INQUIRY_DATA_SIZE; >> + } >> + >> + trace_ufs_scsi_emulate_vpd_page_80(req->cmd.xfer); >> + memcpy(outbuf + buflen, u->params.serial, l); >> + buflen += l; >> + break; >> + } >> + case 0x87: /* Mode Page Policy, mandatory */ >> + { >> + trace_ufs_scsi_emulate_vpd_page_87(req->cmd.xfer); >> + outbuf[buflen++] = 0x3f; /* apply to all mode pages and subpages */ >> + outbuf[buflen++] = 0xff; >> + outbuf[buflen++] = 0; /* shared */ >> + outbuf[buflen++] = 0; >> + break; >> + } >> + default: >> + return -1; >> + } >> + /* done with EVPD */ >> + assert(buflen - start <= 255); >> + outbuf[start - 1] = buflen - start; >> + return buflen; >> +} >> + >> +static int ufs_scsi_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf, >> + uint32_t outbuf_len) >> +{ >> + int buflen = 0; >> + >> + if (outbuf_len < SCSI_INQUIRY_DATA_SIZE) { >> + return -1; >> + } >> + >> + if (req->cmd.buf[1] & 0x1) { >> + /* Vital product data */ >> + return ufs_scsi_emulate_vpd_page(req, outbuf, outbuf_len); >> + } >> + >> + /* Standard INQUIRY data */ >> + if (req->cmd.buf[2] != 0) { >> + return -1; >> + } >> + >> + /* PAGE CODE == 0 */ >> + buflen = req->cmd.xfer; >> + if (buflen > SCSI_MAX_INQUIRY_LEN) { >> + buflen = SCSI_MAX_INQUIRY_LEN; >> + } >> + >> + if (is_wlun(req->lun)) { >> + outbuf[0] = TYPE_WLUN; >> + } else { >> + outbuf[0] = 0; >> + } >> + outbuf[1] = 0; >> + >> + strpadcpy((char *)&outbuf[16], 16, "QEMU UFS", ' '); >> + strpadcpy((char *)&outbuf[8], 8, "QEMU", ' '); >> + >> + memset(&outbuf[32], 0, 4); >> + >> + outbuf[2] = 0x06; /* SPC-4 */ >> + outbuf[3] = 0x2; >> + >> + if (buflen > SCSI_INQUIRY_DATA_SIZE) { >> + outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */ >> + } else { >> + /* >> + * If the allocation length of CDB is too small, the additional >> + * length is not adjusted >> + */ >> + outbuf[4] = SCSI_INQUIRY_DATA_SIZE - 5; >> + } >> + >> + /* Support TCQ. */ >> + outbuf[7] = req->bus->info->tcq ? 0x02 : 0; >> + return buflen; >> +} >> + >> +static int mode_sense_page(UfsLu *lu, int page, uint8_t **p_outbuf, >> + int page_control) >> +{ >> + static const int mode_sense_valid[0x3f] = { >> + [MODE_PAGE_CACHING] = 1, >> + [MODE_PAGE_R_W_ERROR] = 1, >> + [MODE_PAGE_CONTROL] = 1, >> + }; >> + >> + uint8_t *p = *p_outbuf + 2; >> + int length; >> + >> + assert(page < ARRAY_SIZE(mode_sense_valid)); >> + if ((mode_sense_valid[page]) == 0) { >> + return -1; >> + } >> + >> + /* >> + * If Changeable Values are requested, a mask denoting those mode >> parameters >> + * that are changeable shall be returned. As we currently don't support >> + * parameter changes via MODE_SELECT all bits are returned set to zero. >> + * The buffer was already memset to zero by the caller of this function. >> + */ >> + switch (page) { >> + case MODE_PAGE_CACHING: >> + length = 0x12; >> + if (page_control == 1 || /* Changeable Values */ >> + blk_enable_write_cache(lu->qdev.conf.blk)) { >> + p[0] = 4; /* WCE */ >> + } >> + break; >> + >> + case MODE_PAGE_R_W_ERROR: >> + length = 10; >> + if (page_control == 1) { /* Changeable Values */ >> + break; >> + } >> + p[0] = 0x80; /* Automatic Write Reallocation Enabled */ >> + break; >> + >> + case MODE_PAGE_CONTROL: >> + length = 10; >> + if (page_control == 1) { /* Changeable Values */ >> + break; >> + } >> + p[1] = 0x10; /* Queue Algorithm modifier */ >> + p[8] = 0xff; /* Busy Timeout Period */ >> + p[9] = 0xff; >> + break; >> + >> + default: >> + return -1; >> + } >> + >> + assert(length < 256); >> + (*p_outbuf)[0] = page; >> + (*p_outbuf)[1] = length; >> + *p_outbuf += length + 2; >> + return length + 2; >> +} >> + >> +static int ufs_scsi_emulate_mode_sense(UfsSCSIReq *r, uint8_t *outbuf) >> +{ >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + bool dbd; >> + int page, buflen, ret, page_control; >> + uint8_t *p; >> + uint8_t dev_specific_param = 0; >> + >> + dbd = (r->req.cmd.buf[1] & 0x8) != 0; >> + if (!dbd) { >> + return -1; >> + } >> + >> + page = r->req.cmd.buf[2] & 0x3f; >> + page_control = (r->req.cmd.buf[2] & 0xc0) >> 6; >> + >> + trace_ufs_scsi_emulate_mode_sense((r->req.cmd.buf[0] == MODE_SENSE) ? 6 >> : >> + >> 10, >> + page, r->req.cmd.xfer, page_control); >> + memset(outbuf, 0, r->req.cmd.xfer); >> + p = outbuf; >> + >> + if (!blk_is_writable(lu->qdev.conf.blk)) { >> + dev_specific_param |= 0x80; /* Readonly. */ >> + } >> + >> + p[2] = 0; /* Medium type. */ >> + p[3] = dev_specific_param; >> + p[6] = p[7] = 0; /* Block descriptor length. */ >> + p += 8; >> + >> + if (page_control == 3) { >> + /* Saved Values */ >> + scsi_check_condition(r, SENSE_CODE(SAVING_PARAMS_NOT_SUPPORTED)); >> + return -1; >> + } >> + >> + if (page == 0x3f) { >> + for (page = 0; page <= 0x3e; page++) { >> + mode_sense_page(lu, page, &p, page_control); >> + } >> + } else { >> + ret = mode_sense_page(lu, page, &p, page_control); >> + if (ret == -1) { >> + return -1; >> + } >> + } >> + >> + buflen = p - outbuf; >> + /* >> + * The mode data length field specifies the length in bytes of the >> + * following data that is available to be transferred. The mode data >> + * length does not include itself. >> + */ >> + outbuf[0] = ((buflen - 2) >> 8) & 0xff; >> + outbuf[1] = (buflen - 2) & 0xff; >> + return buflen; >> +} >> + >> +/* >> + * scsi_handle_rw_error has two return values. False means that the error >> + * must be ignored, true means that the error has been processed and the >> + * caller should not do anything else for this request. Note that >> + * scsi_handle_rw_error always manages its reference counts, independent >> + * of the return value. >> + */ >> +static bool scsi_handle_rw_error(UfsSCSIReq *r, int ret, bool acct_failed) >> +{ >> + bool is_read = (r->req.cmd.mode == SCSI_XFER_FROM_DEV); >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + SCSISense sense = SENSE_CODE(NO_SENSE); >> + int error = 0; >> + bool req_has_sense = false; >> + BlockErrorAction action; >> + int status; >> + >> + if (ret < 0) { >> + status = scsi_sense_from_errno(-ret, &sense); >> + error = -ret; >> + } else { >> + /* A passthrough command has completed with nonzero status. */ >> + status = ret; >> + if (status == CHECK_CONDITION) { >> + req_has_sense = true; >> + error = scsi_sense_buf_to_errno(r->req.sense, >> sizeof(r->req.sense)); >> + } else { >> + error = EINVAL; >> + } >> + } >> + >> + /* >> + * Check whether the error has to be handled by the guest or should >> + * rather follow the rerror=/werror= settings. Guest-handled errors >> + * are usually retried immediately, so do not post them to QMP and >> + * do not account them as failed I/O. >> + */ >> + if (req_has_sense && scsi_sense_buf_is_guest_recoverable( >> + r->req.sense, sizeof(r->req.sense))) { >> + action = BLOCK_ERROR_ACTION_REPORT; >> + acct_failed = false; >> + } else { >> + action = blk_get_error_action(lu->qdev.conf.blk, is_read, error); >> + blk_error_action(lu->qdev.conf.blk, action, is_read, error); >> + } >> + >> + switch (action) { >> + case BLOCK_ERROR_ACTION_REPORT: >> + if (acct_failed) { >> + block_acct_failed(blk_get_stats(lu->qdev.conf.blk), &r->acct); >> + } >> + if (!req_has_sense && status == CHECK_CONDITION) { >> + scsi_req_build_sense(&r->req, sense); >> + } >> + scsi_req_complete(&r->req, status); >> + return true; >> + >> + case BLOCK_ERROR_ACTION_IGNORE: >> + return false; >> + >> + case BLOCK_ERROR_ACTION_STOP: >> + scsi_req_retry(&r->req); >> + return true; >> + >> + default: >> + g_assert_not_reached(); >> + } >> +} >> + >> +static bool ufs_scsi_req_check_error(UfsSCSIReq *r, int ret, bool >> acct_failed) >> +{ >> + if (r->req.io_canceled) { >> + scsi_req_cancel_complete(&r->req); >> + return true; >> + } >> + >> + if (ret < 0) { >> + return scsi_handle_rw_error(r, ret, acct_failed); >> + } >> + >> + return false; >> +} >> + >> +static void scsi_aio_complete(void *opaque, int ret) >> +{ >> + UfsSCSIReq *r = (UfsSCSIReq *)opaque; >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + >> + assert(r->req.aiocb != NULL); >> + r->req.aiocb = NULL; >> + aio_context_acquire(blk_get_aio_context(lu->qdev.conf.blk)); >> + if (ufs_scsi_req_check_error(r, ret, true)) { >> + goto done; >> + } >> + >> + block_acct_done(blk_get_stats(lu->qdev.conf.blk), &r->acct); >> + scsi_req_complete(&r->req, GOOD); >> + >> +done: >> + aio_context_release(blk_get_aio_context(lu->qdev.conf.blk)); >> + scsi_req_unref(&r->req); >> +} >> + >> +static int32_t ufs_scsi_emulate_command(SCSIRequest *req, uint8_t *buf) >> +{ >> + UfsSCSIReq *r = DO_UPCAST(UfsSCSIReq, req, req); >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, req->dev); >> + uint8_t *outbuf; >> + int buflen; >> + >> + switch (req->cmd.buf[0]) { >> + case INQUIRY: >> + case MODE_SENSE_10: >> + case START_STOP: >> + case REQUEST_SENSE: >> + break; >> + >> + default: >> + if (!blk_is_available(lu->qdev.conf.blk)) { >> + scsi_check_condition(r, SENSE_CODE(NO_MEDIUM)); >> + return 0; >> + } >> + break; >> + } >> + >> + /* >> + * FIXME: we shouldn't return anything bigger than 4k, but the code >> + * requires the buffer to be as big as req->cmd.xfer in several >> + * places. So, do not allow CDBs with a very large ALLOCATION >> + * LENGTH. The real fix would be to modify scsi_read_data and >> + * dma_buf_read, so that they return data beyond the buflen >> + * as all zeros. >> + */ >> + if (req->cmd.xfer > 65536) { >> + goto illegal_request; >> + } >> + r->buflen = MAX(4096, req->cmd.xfer); >> + >> + if (!r->iov.iov_base) { >> + r->iov.iov_base = blk_blockalign(lu->qdev.conf.blk, r->buflen); >> + } >> + >> + outbuf = r->iov.iov_base; >> + memset(outbuf, 0, r->buflen); >> + switch (req->cmd.buf[0]) { >> + case TEST_UNIT_READY: >> + assert(blk_is_available(lu->qdev.conf.blk)); >> + break; >> + case INQUIRY: >> + buflen = ufs_scsi_emulate_inquiry(req, outbuf, r->buflen); >> + if (buflen < 0) { >> + goto illegal_request; >> + } >> + break; >> + case MODE_SENSE_10: >> + buflen = ufs_scsi_emulate_mode_sense(r, outbuf); >> + if (buflen < 0) { >> + goto illegal_request; >> + } >> + break; >> + case READ_CAPACITY_10: >> + /* The normal LEN field for this command is zero. */ >> + memset(outbuf, 0, 8); >> + >> + outbuf[0] = (lu->qdev.max_lba >> 24) & 0xff; >> + outbuf[1] = (lu->qdev.max_lba >> 16) & 0xff; >> + outbuf[2] = (lu->qdev.max_lba >> 8) & 0xff; >> + outbuf[3] = lu->qdev.max_lba & 0xff; >> + outbuf[4] = (lu->qdev.blocksize >> 24) & 0xff; >> + outbuf[5] = (lu->qdev.blocksize >> 16) & 0xff; >> + outbuf[6] = (lu->qdev.blocksize >> 8) & 0xff; >> + outbuf[7] = lu->qdev.blocksize & 0xff; >> + break; >> + case REQUEST_SENSE: >> + /* Just return "NO SENSE". */ >> + buflen = scsi_convert_sense(NULL, 0, outbuf, r->buflen, >> + (req->cmd.buf[1] & 1) == 0); >> + if (buflen < 0) { >> + goto illegal_request; >> + } >> + break; >> + case SYNCHRONIZE_CACHE: >> + /* The request is used as the AIO opaque value, so add a ref. */ >> + scsi_req_ref(&r->req); >> + block_acct_start(blk_get_stats(lu->qdev.conf.blk), &r->acct, 0, >> + BLOCK_ACCT_FLUSH); >> + r->req.aiocb = blk_aio_flush(lu->qdev.conf.blk, scsi_aio_complete, >> r); >> + return 0; >> + case VERIFY_10: >> + trace_ufs_scsi_emulate_command_VERIFY((req->cmd.buf[1] >> 1) & 3); >> + if (req->cmd.buf[1] & 6) { >> + goto illegal_request; >> + } >> + break; >> + case SERVICE_ACTION_IN_16: >> + /* Service Action In subcommands. */ >> + if ((req->cmd.buf[1] & 31) == SAI_READ_CAPACITY_16) { >> + trace_ufs_scsi_emulate_command_SAI_16(); >> + memset(outbuf, 0, req->cmd.xfer); >> + >> + outbuf[0] = (lu->qdev.max_lba >> 56) & 0xff; >> + outbuf[1] = (lu->qdev.max_lba >> 48) & 0xff; >> + outbuf[2] = (lu->qdev.max_lba >> 40) & 0xff; >> + outbuf[3] = (lu->qdev.max_lba >> 32) & 0xff; >> + outbuf[4] = (lu->qdev.max_lba >> 24) & 0xff; >> + outbuf[5] = (lu->qdev.max_lba >> 16) & 0xff; >> + outbuf[6] = (lu->qdev.max_lba >> 8) & 0xff; >> + outbuf[7] = lu->qdev.max_lba & 0xff; >> + outbuf[8] = (lu->qdev.blocksize >> 24) & 0xff; >> + outbuf[9] = (lu->qdev.blocksize >> 16) & 0xff; >> + outbuf[10] = (lu->qdev.blocksize >> 8) & 0xff; >> + outbuf[11] = lu->qdev.blocksize & 0xff; >> + outbuf[12] = 0; >> + outbuf[13] = get_physical_block_exp(&lu->qdev.conf); >> + >> + if (lu->unit_desc.provisioning_type == 2 || >> + lu->unit_desc.provisioning_type == 3) { >> + outbuf[14] = 0x80; >> + } >> + /* Protection, exponent and lowest lba field left blank. */ >> + break; >> + } >> + trace_ufs_scsi_emulate_command_SAI_unsupported(); >> + goto illegal_request; >> + case MODE_SELECT_10: >> + trace_ufs_scsi_emulate_command_MODE_SELECT_10(r->req.cmd.xfer); >> + break; >> + case START_STOP: >> + /* >> + * TODO: START_STOP is not yet implemented. It always returns >> success. >> + * Revisit it when ufs power management is implemented. >> + */ >> + trace_ufs_scsi_emulate_command_START_STOP(); >> + break; >> + case FORMAT_UNIT: >> + trace_ufs_scsi_emulate_command_FORMAT_UNIT(); >> + break; >> + case SEND_DIAGNOSTIC: >> + trace_ufs_scsi_emulate_command_SEND_DIAGNOSTIC(); >> + break; >> + default: >> + trace_ufs_scsi_emulate_command_UNKNOWN(buf[0], >> + scsi_command_name(buf[0])); >> + scsi_check_condition(r, SENSE_CODE(INVALID_OPCODE)); >> + return 0; >> + } >> + assert(!r->req.aiocb); >> + r->iov.iov_len = MIN(r->buflen, req->cmd.xfer); >> + if (r->iov.iov_len == 0) { >> + scsi_req_complete(&r->req, GOOD); >> + } >> + if (r->req.cmd.mode == SCSI_XFER_TO_DEV) { >> + assert(r->iov.iov_len == req->cmd.xfer); >> + return -r->iov.iov_len; >> + } else { >> + return r->iov.iov_len; >> + } >> + >> +illegal_request: >> + if (r->req.status == -1) { >> + scsi_check_condition(r, SENSE_CODE(INVALID_FIELD)); >> + } >> + return 0; >> +} >> + >> +static void ufs_scsi_emulate_read_data(SCSIRequest *req) >> +{ >> + UfsSCSIReq *r = DO_UPCAST(UfsSCSIReq, req, req); >> + int buflen = r->iov.iov_len; >> + >> + if (buflen) { >> + trace_ufs_scsi_emulate_read_data(buflen); >> + r->iov.iov_len = 0; >> + r->started = true; >> + scsi_req_data(&r->req, buflen); >> + return; >> + } >> + >> + /* This also clears the sense buffer for REQUEST SENSE. */ >> + scsi_req_complete(&r->req, GOOD); >> +} >> + >> +static int ufs_scsi_check_mode_select(UfsLu *lu, int page, uint8_t *inbuf, >> + int inlen) >> +{ >> + uint8_t mode_current[SCSI_MAX_MODE_LEN]; >> + uint8_t mode_changeable[SCSI_MAX_MODE_LEN]; >> + uint8_t *p; >> + int len, expected_len, changeable_len, i; >> + >> + /* >> + * The input buffer does not include the page header, so it is >> + * off by 2 bytes. >> + */ >> + expected_len = inlen + 2; >> + if (expected_len > SCSI_MAX_MODE_LEN) { >> + return -1; >> + } >> + >> + /* MODE_PAGE_ALLS is only valid for MODE SENSE commands */ >> + if (page == MODE_PAGE_ALLS) { >> + return -1; >> + } >> + >> + p = mode_current; >> + memset(mode_current, 0, inlen + 2); >> + len = mode_sense_page(lu, page, &p, 0); >> + if (len < 0 || len != expected_len) { >> + return -1; >> + } >> + >> + p = mode_changeable; >> + memset(mode_changeable, 0, inlen + 2); >> + changeable_len = mode_sense_page(lu, page, &p, 1); >> + assert(changeable_len == len); >> + >> + /* >> + * Check that unchangeable bits are the same as what MODE SENSE >> + * would return. >> + */ >> + for (i = 2; i < len; i++) { >> + if (((mode_current[i] ^ inbuf[i - 2]) & ~mode_changeable[i]) != 0) { >> + return -1; >> + } >> + } >> + return 0; >> +} >> + >> +static void ufs_scsi_apply_mode_select(UfsLu *lu, int page, uint8_t *p) >> +{ >> + switch (page) { >> + case MODE_PAGE_CACHING: >> + blk_set_enable_write_cache(lu->qdev.conf.blk, (p[0] & 4) != 0); >> + break; >> + >> + default: >> + break; >> + } >> +} >> + >> +static int mode_select_pages(UfsSCSIReq *r, uint8_t *p, int len, bool >> change) >> +{ >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + >> + while (len > 0) { >> + int page, page_len; >> + >> + page = p[0] & 0x3f; >> + if (p[0] & 0x40) { >> + goto invalid_param; >> + } else { >> + if (len < 2) { >> + goto invalid_param_len; >> + } >> + page_len = p[1]; >> + p += 2; >> + len -= 2; >> + } >> + >> + if (page_len > len) { >> + goto invalid_param_len; >> + } >> + >> + if (!change) { >> + if (ufs_scsi_check_mode_select(lu, page, p, page_len) < 0) { >> + goto invalid_param; >> + } >> + } else { >> + ufs_scsi_apply_mode_select(lu, page, p); >> + } >> + >> + p += page_len; >> + len -= page_len; >> + } >> + return 0; >> + >> +invalid_param: >> + scsi_check_condition(r, SENSE_CODE(INVALID_PARAM)); >> + return -1; >> + >> +invalid_param_len: >> + scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN)); >> + return -1; >> +} >> + >> +static void ufs_scsi_emulate_mode_select(UfsSCSIReq *r, uint8_t *inbuf) >> +{ >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + uint8_t *p = inbuf; >> + int len = r->req.cmd.xfer; >> + int hdr_len = 8; >> + int bd_len; >> + int pass; >> + >> + /* We only support PF=1, SP=0. */ >> + if ((r->req.cmd.buf[1] & 0x11) != 0x10) { >> + goto invalid_field; >> + } >> + >> + if (len < hdr_len) { >> + goto invalid_param_len; >> + } >> + >> + bd_len = lduw_be_p(&p[6]); >> + if (bd_len != 0) { >> + goto invalid_param; >> + } >> + >> + len -= hdr_len; >> + p += hdr_len; >> + >> + /* Ensure no change is made if there is an error! */ >> + for (pass = 0; pass < 2; pass++) { >> + if (mode_select_pages(r, p, len, pass == 1) < 0) { >> + assert(pass == 0); >> + return; >> + } >> + } >> + >> + if (!blk_enable_write_cache(lu->qdev.conf.blk)) { >> + /* The request is used as the AIO opaque value, so add a ref. */ >> + scsi_req_ref(&r->req); >> + block_acct_start(blk_get_stats(lu->qdev.conf.blk), &r->acct, 0, >> + BLOCK_ACCT_FLUSH); >> + r->req.aiocb = blk_aio_flush(lu->qdev.conf.blk, scsi_aio_complete, >> r); >> + return; >> + } >> + >> + scsi_req_complete(&r->req, GOOD); >> + return; >> + >> +invalid_param: >> + scsi_check_condition(r, SENSE_CODE(INVALID_PARAM)); >> + return; >> + >> +invalid_param_len: >> + scsi_check_condition(r, SENSE_CODE(INVALID_PARAM_LEN)); >> + return; >> + >> +invalid_field: >> + scsi_check_condition(r, SENSE_CODE(INVALID_FIELD)); >> +} >> + >> +/* sector_num and nb_sectors expected to be in qdev blocksize */ >> +static inline bool check_lba_range(UfsLu *lu, uint64_t sector_num, >> + uint32_t nb_sectors) >> +{ >> + /* >> + * The first line tests that no overflow happens when computing the last >> + * sector. The second line tests that the last accessed sector is in >> + * range. >> + * >> + * Careful, the computations should not underflow for nb_sectors == 0, >> + * and a 0-block read to the first LBA beyond the end of device is >> + * valid. >> + */ >> + return (sector_num <= sector_num + nb_sectors && >> + sector_num + nb_sectors <= lu->qdev.max_lba + 1); >> +} >> + >> +static void ufs_scsi_emulate_write_data(SCSIRequest *req) >> +{ >> + UfsSCSIReq *r = DO_UPCAST(UfsSCSIReq, req, req); >> + >> + if (r->iov.iov_len) { >> + int buflen = r->iov.iov_len; >> + trace_ufs_scsi_emulate_write_data(buflen); >> + r->iov.iov_len = 0; >> + scsi_req_data(&r->req, buflen); >> + return; >> + } >> + >> + switch (req->cmd.buf[0]) { >> + case MODE_SELECT_10: >> + /* This also clears the sense buffer for REQUEST SENSE. */ >> + ufs_scsi_emulate_mode_select(r, r->iov.iov_base); >> + break; >> + default: >> + abort(); >> + } >> +} >> + >> +/* Return a pointer to the data buffer. */ >> +static uint8_t *ufs_scsi_get_buf(SCSIRequest *req) >> +{ >> + UfsSCSIReq *r = DO_UPCAST(UfsSCSIReq, req, req); >> + >> + return (uint8_t *)r->iov.iov_base; >> +} >> + >> +static int32_t ufs_scsi_dma_command(SCSIRequest *req, uint8_t *buf) >> +{ >> + UfsSCSIReq *r = DO_UPCAST(UfsSCSIReq, req, req); >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, req->dev); >> + uint32_t len; >> + uint8_t command; >> + >> + command = buf[0]; >> + >> + if (!blk_is_available(lu->qdev.conf.blk)) { >> + scsi_check_condition(r, SENSE_CODE(NO_MEDIUM)); >> + return 0; >> + } >> + >> + len = scsi_data_cdb_xfer(r->req.cmd.buf); >> + switch (command) { >> + case READ_6: >> + case READ_10: >> + trace_ufs_scsi_dma_command_READ(r->req.cmd.lba, len); >> + if (r->req.cmd.buf[1] & 0xe0) { >> + goto illegal_request; >> + } >> + if (!check_lba_range(lu, r->req.cmd.lba, len)) { >> + goto illegal_lba; >> + } >> + r->sector = r->req.cmd.lba * (lu->qdev.blocksize / >> BDRV_SECTOR_SIZE); >> + r->sector_count = len * (lu->qdev.blocksize / BDRV_SECTOR_SIZE); >> + break; >> + case WRITE_6: >> + case WRITE_10: >> + trace_ufs_scsi_dma_command_WRITE(r->req.cmd.lba, len); >> + if (!blk_is_writable(lu->qdev.conf.blk)) { >> + scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED)); >> + return 0; >> + } >> + if (r->req.cmd.buf[1] & 0xe0) { >> + goto illegal_request; >> + } >> + if (!check_lba_range(lu, r->req.cmd.lba, len)) { >> + goto illegal_lba; >> + } >> + r->sector = r->req.cmd.lba * (lu->qdev.blocksize / >> BDRV_SECTOR_SIZE); >> + r->sector_count = len * (lu->qdev.blocksize / BDRV_SECTOR_SIZE); >> + break; >> + default: >> + abort(); >> + illegal_request: >> + scsi_check_condition(r, SENSE_CODE(INVALID_FIELD)); >> + return 0; >> + illegal_lba: >> + scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE)); >> + return 0; >> + } >> + r->need_fua_emulation = ((r->req.cmd.buf[1] & 8) != 0); >> + if (r->sector_count == 0) { >> + scsi_req_complete(&r->req, GOOD); >> + } >> + assert(r->iov.iov_len == 0); >> + if (r->req.cmd.mode == SCSI_XFER_TO_DEV) { >> + return -r->sector_count * BDRV_SECTOR_SIZE; >> + } else { >> + return r->sector_count * BDRV_SECTOR_SIZE; >> + } >> +} >> + >> +static void scsi_write_do_fua(UfsSCSIReq *r) >> +{ >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + >> + assert(r->req.aiocb == NULL); >> + assert(!r->req.io_canceled); >> + >> + if (r->need_fua_emulation) { >> + block_acct_start(blk_get_stats(lu->qdev.conf.blk), &r->acct, 0, >> + BLOCK_ACCT_FLUSH); >> + r->req.aiocb = blk_aio_flush(lu->qdev.conf.blk, scsi_aio_complete, >> r); >> + return; >> + } >> + >> + scsi_req_complete(&r->req, GOOD); >> + scsi_req_unref(&r->req); >> +} >> + >> +static void scsi_dma_complete_noio(UfsSCSIReq *r, int ret) >> +{ >> + assert(r->req.aiocb == NULL); >> + if (ufs_scsi_req_check_error(r, ret, false)) { >> + goto done; >> + } >> + >> + r->sector += r->sector_count; >> + r->sector_count = 0; >> + if (r->req.cmd.mode == SCSI_XFER_TO_DEV) { >> + scsi_write_do_fua(r); >> + return; >> + } else { >> + scsi_req_complete(&r->req, GOOD); >> + } >> + >> +done: >> + scsi_req_unref(&r->req); >> +} >> + >> +static void scsi_dma_complete(void *opaque, int ret) >> +{ >> + UfsSCSIReq *r = (UfsSCSIReq *)opaque; >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + >> + assert(r->req.aiocb != NULL); >> + r->req.aiocb = NULL; >> + >> + aio_context_acquire(blk_get_aio_context(lu->qdev.conf.blk)); >> + if (ret < 0) { >> + block_acct_failed(blk_get_stats(lu->qdev.conf.blk), &r->acct); >> + } else { >> + block_acct_done(blk_get_stats(lu->qdev.conf.blk), &r->acct); >> + } >> + scsi_dma_complete_noio(r, ret); >> + aio_context_release(blk_get_aio_context(lu->qdev.conf.blk)); >> +} >> + >> +static BlockAIOCB *scsi_dma_readv(int64_t offset, QEMUIOVector *iov, >> + BlockCompletionFunc *cb, void *cb_opaque, >> + void *opaque) >> +{ >> + UfsSCSIReq *r = opaque; >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + return blk_aio_preadv(lu->qdev.conf.blk, offset, iov, 0, cb, cb_opaque); >> +} >> + >> +static void scsi_init_iovec(UfsSCSIReq *r, size_t size) >> +{ >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + >> + if (!r->iov.iov_base) { >> + r->buflen = size; >> + r->iov.iov_base = blk_blockalign(lu->qdev.conf.blk, r->buflen); >> + } >> + r->iov.iov_len = MIN(r->sector_count * BDRV_SECTOR_SIZE, r->buflen); >> + qemu_iovec_init_external(&r->qiov, &r->iov, 1); >> +} >> + >> +static void scsi_read_complete_noio(UfsSCSIReq *r, int ret) >> +{ >> + uint32_t n; >> + >> + assert(r->req.aiocb == NULL); >> + if (ufs_scsi_req_check_error(r, ret, false)) { >> + goto done; >> + } >> + >> + n = r->qiov.size / BDRV_SECTOR_SIZE; >> + r->sector += n; >> + r->sector_count -= n; >> + scsi_req_data(&r->req, r->qiov.size); >> + >> +done: >> + scsi_req_unref(&r->req); >> +} >> + >> +static void scsi_read_complete(void *opaque, int ret) >> +{ >> + UfsSCSIReq *r = (UfsSCSIReq *)opaque; >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + >> + assert(r->req.aiocb != NULL); >> + r->req.aiocb = NULL; >> + trace_ufs_scsi_read_data_count(r->sector_count); >> + aio_context_acquire(blk_get_aio_context(lu->qdev.conf.blk)); >> + if (ret < 0) { >> + block_acct_failed(blk_get_stats(lu->qdev.conf.blk), &r->acct); >> + } else { >> + block_acct_done(blk_get_stats(lu->qdev.conf.blk), &r->acct); >> + trace_ufs_scsi_read_complete(r->req.tag, r->qiov.size); >> + } >> + scsi_read_complete_noio(r, ret); >> + aio_context_release(blk_get_aio_context(lu->qdev.conf.blk)); >> +} >> + >> +/* Actually issue a read to the block device. */ >> +static void scsi_do_read(UfsSCSIReq *r, int ret) >> +{ >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + >> + assert(r->req.aiocb == NULL); >> + if (ufs_scsi_req_check_error(r, ret, false)) { >> + goto done; >> + } >> + >> + /* The request is used as the AIO opaque value, so add a ref. */ >> + scsi_req_ref(&r->req); >> + >> + if (r->req.sg) { >> + dma_acct_start(lu->qdev.conf.blk, &r->acct, r->req.sg, >> BLOCK_ACCT_READ); >> + r->req.residual -= r->req.sg->size; >> + r->req.aiocb = dma_blk_io( >> + blk_get_aio_context(lu->qdev.conf.blk), r->req.sg, >> + r->sector << BDRV_SECTOR_BITS, BDRV_SECTOR_SIZE, >> scsi_dma_readv, r, >> + scsi_dma_complete, r, DMA_DIRECTION_FROM_DEVICE); >> + } else { >> + scsi_init_iovec(r, SCSI_DMA_BUF_SIZE); >> + block_acct_start(blk_get_stats(lu->qdev.conf.blk), &r->acct, >> + r->qiov.size, BLOCK_ACCT_READ); >> + r->req.aiocb = scsi_dma_readv(r->sector << BDRV_SECTOR_BITS, >> &r->qiov, >> + scsi_read_complete, r, r); >> + } >> + >> +done: >> + scsi_req_unref(&r->req); >> +} >> + >> +static void scsi_do_read_cb(void *opaque, int ret) >> +{ >> + UfsSCSIReq *r = (UfsSCSIReq *)opaque; >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + >> + assert(r->req.aiocb != NULL); >> + r->req.aiocb = NULL; >> + >> + aio_context_acquire(blk_get_aio_context(lu->qdev.conf.blk)); >> + if (ret < 0) { >> + block_acct_failed(blk_get_stats(lu->qdev.conf.blk), &r->acct); >> + } else { >> + block_acct_done(blk_get_stats(lu->qdev.conf.blk), &r->acct); >> + } >> + scsi_do_read(opaque, ret); >> + aio_context_release(blk_get_aio_context(lu->qdev.conf.blk)); >> +} >> + >> +/* Read more data from scsi device into buffer. */ >> +static void scsi_read_data(SCSIRequest *req) >> +{ >> + UfsSCSIReq *r = DO_UPCAST(UfsSCSIReq, req, req); >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + bool first; >> + >> + trace_ufs_scsi_read_data_count(r->sector_count); >> + if (r->sector_count == 0) { >> + /* This also clears the sense buffer for REQUEST SENSE. */ >> + scsi_req_complete(&r->req, GOOD); >> + return; >> + } >> + >> + /* No data transfer may already be in progress */ >> + assert(r->req.aiocb == NULL); >> + >> + /* The request is used as the AIO opaque value, so add a ref. */ >> + scsi_req_ref(&r->req); >> + if (r->req.cmd.mode == SCSI_XFER_TO_DEV) { >> + trace_ufs_scsi_read_data_invalid(); >> + scsi_read_complete_noio(r, -EINVAL); >> + return; >> + } >> + >> + if (!blk_is_available(req->dev->conf.blk)) { >> + scsi_read_complete_noio(r, -ENOMEDIUM); >> + return; >> + } >> + >> + first = !r->started; >> + r->started = true; >> + if (first && r->need_fua_emulation) { >> + block_acct_start(blk_get_stats(lu->qdev.conf.blk), &r->acct, 0, >> + BLOCK_ACCT_FLUSH); >> + r->req.aiocb = blk_aio_flush(lu->qdev.conf.blk, scsi_do_read_cb, r); >> + } else { >> + scsi_do_read(r, 0); >> + } >> +} >> + >> +static void scsi_write_complete_noio(UfsSCSIReq *r, int ret) >> +{ >> + uint32_t n; >> + >> + assert(r->req.aiocb == NULL); >> + if (ufs_scsi_req_check_error(r, ret, false)) { >> + goto done; >> + } >> + >> + n = r->qiov.size / BDRV_SECTOR_SIZE; >> + r->sector += n; >> + r->sector_count -= n; >> + if (r->sector_count == 0) { >> + scsi_write_do_fua(r); >> + return; >> + } else { >> + scsi_init_iovec(r, SCSI_DMA_BUF_SIZE); >> + trace_ufs_scsi_write_complete_noio(r->req.tag, r->qiov.size); >> + scsi_req_data(&r->req, r->qiov.size); >> + } >> + >> +done: >> + scsi_req_unref(&r->req); >> +} >> + >> +static void scsi_write_complete(void *opaque, int ret) >> +{ >> + UfsSCSIReq *r = (UfsSCSIReq *)opaque; >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + >> + assert(r->req.aiocb != NULL); >> + r->req.aiocb = NULL; >> + >> + aio_context_acquire(blk_get_aio_context(lu->qdev.conf.blk)); >> + if (ret < 0) { >> + block_acct_failed(blk_get_stats(lu->qdev.conf.blk), &r->acct); >> + } else { >> + block_acct_done(blk_get_stats(lu->qdev.conf.blk), &r->acct); >> + } >> + scsi_write_complete_noio(r, ret); >> + aio_context_release(blk_get_aio_context(lu->qdev.conf.blk)); >> +} >> + >> +static BlockAIOCB *scsi_dma_writev(int64_t offset, QEMUIOVector *iov, >> + BlockCompletionFunc *cb, void *cb_opaque, >> + void *opaque) >> +{ >> + UfsSCSIReq *r = opaque; >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + return blk_aio_pwritev(lu->qdev.conf.blk, offset, iov, 0, cb, >> cb_opaque); >> +} >> + >> +static void scsi_write_data(SCSIRequest *req) >> +{ >> + UfsSCSIReq *r = DO_UPCAST(UfsSCSIReq, req, req); >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, r->req.dev); >> + >> + /* No data transfer may already be in progress */ >> + assert(r->req.aiocb == NULL); >> + >> + /* The request is used as the AIO opaque value, so add a ref. */ >> + scsi_req_ref(&r->req); >> + if (r->req.cmd.mode != SCSI_XFER_TO_DEV) { >> + trace_ufs_scsi_write_data_invalid(); >> + scsi_write_complete_noio(r, -EINVAL); >> + return; >> + } >> + >> + if (!r->req.sg && !r->qiov.size) { >> + /* Called for the first time. Ask the driver to send us more data. >> */ >> + r->started = true; >> + scsi_write_complete_noio(r, 0); >> + return; >> + } >> + if (!blk_is_available(req->dev->conf.blk)) { >> + scsi_write_complete_noio(r, -ENOMEDIUM); >> + return; >> + } >> + >> + if (r->req.sg) { >> + dma_acct_start(lu->qdev.conf.blk, &r->acct, r->req.sg, >> + BLOCK_ACCT_WRITE); >> + r->req.residual -= r->req.sg->size; >> + r->req.aiocb = dma_blk_io( >> + blk_get_aio_context(lu->qdev.conf.blk), r->req.sg, >> + r->sector << BDRV_SECTOR_BITS, BDRV_SECTOR_SIZE, >> scsi_dma_writev, r, >> + scsi_dma_complete, r, DMA_DIRECTION_TO_DEVICE); >> + } else { >> + block_acct_start(blk_get_stats(lu->qdev.conf.blk), &r->acct, >> + r->qiov.size, BLOCK_ACCT_WRITE); >> + r->req.aiocb = scsi_dma_writev(r->sector << BDRV_SECTOR_BITS, >> &r->qiov, >> + scsi_write_complete, r, r); >> + } >> +} >> + >> +static const SCSIReqOps ufs_scsi_emulate_reqops = { >> + .size = sizeof(UfsSCSIReq), >> + .free_req = ufs_scsi_free_request, >> + .send_command = ufs_scsi_emulate_command, >> + .read_data = ufs_scsi_emulate_read_data, >> + .write_data = ufs_scsi_emulate_write_data, >> + .get_buf = ufs_scsi_get_buf, >> +}; >> + >> +static const SCSIReqOps ufs_scsi_dma_reqops = { >> + .size = sizeof(UfsSCSIReq), >> + .free_req = ufs_scsi_free_request, >> + .send_command = ufs_scsi_dma_command, >> + .read_data = scsi_read_data, >> + .write_data = scsi_write_data, >> + .get_buf = ufs_scsi_get_buf, >> +}; >> + >> +/* >> + * Following commands are not yet supported >> + * PRE_FETCH(10), >> + * UNMAP, >> + * WRITE_BUFFER, READ_BUFFER, >> + * SECURITY_PROTOCOL_IN, SECURITY_PROTOCOL_OUT >> + */ >> +static const SCSIReqOps *const ufs_scsi_reqops_dispatch[256] = { >> + [TEST_UNIT_READY] = &ufs_scsi_emulate_reqops, >> + [INQUIRY] = &ufs_scsi_emulate_reqops, >> + [MODE_SENSE_10] = &ufs_scsi_emulate_reqops, >> + [START_STOP] = &ufs_scsi_emulate_reqops, >> + [READ_CAPACITY_10] = &ufs_scsi_emulate_reqops, >> + [REQUEST_SENSE] = &ufs_scsi_emulate_reqops, >> + [SYNCHRONIZE_CACHE] = &ufs_scsi_emulate_reqops, >> + [MODE_SELECT_10] = &ufs_scsi_emulate_reqops, >> + [VERIFY_10] = &ufs_scsi_emulate_reqops, >> + [FORMAT_UNIT] = &ufs_scsi_emulate_reqops, >> + [SERVICE_ACTION_IN_16] = &ufs_scsi_emulate_reqops, >> + [SEND_DIAGNOSTIC] = &ufs_scsi_emulate_reqops, >> + >> + [READ_6] = &ufs_scsi_dma_reqops, >> + [READ_10] = &ufs_scsi_dma_reqops, >> + [WRITE_6] = &ufs_scsi_dma_reqops, >> + [WRITE_10] = &ufs_scsi_dma_reqops, >> +}; >> + >> +static SCSIRequest *scsi_new_request(SCSIDevice *dev, uint32_t tag, >> + uint32_t lun, uint8_t *buf, >> + void *hba_private) >> +{ >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, dev); >> + SCSIRequest *req; >> + const SCSIReqOps *ops; >> + uint8_t command; >> + >> + command = buf[0]; >> + ops = ufs_scsi_reqops_dispatch[command]; >> + if (!ops) { >> + ops = &ufs_scsi_emulate_reqops; >> + } >> + req = scsi_req_alloc(ops, &lu->qdev, tag, lun, hba_private); >> + >> + return req; >> +} >> + >> +static Property ufs_lu_props[] = { >> + DEFINE_PROP_DRIVE_IOTHREAD("drive", UfsLu, qdev.conf.blk), >> + DEFINE_BLOCK_PROPERTIES_BASE(UfsLu, qdev.conf), >> + DEFINE_BLOCK_ERROR_PROPERTIES(UfsLu, qdev.conf), >> + DEFINE_PROP_END_OF_LIST(), >> +}; >> + >> +static bool ufs_lu_brdv_init(UfsLu *lu, Error **errp) >> +{ >> + SCSIDevice *dev = &lu->qdev; >> + bool read_only; >> + >> + if (!lu->qdev.conf.blk) { >> + error_setg(errp, "drive property not set"); >> + return false; >> + } >> + >> + if (!blkconf_blocksizes(&lu->qdev.conf, errp)) { >> + return false; >> + } >> + >> + if (blk_get_aio_context(lu->qdev.conf.blk) != qemu_get_aio_context() && >> + !lu->qdev.hba_supports_iothread) { >> + error_setg(errp, "HBA does not support iothreads"); >> + return false; >> + } >> + >> + read_only = !blk_supports_write_perm(lu->qdev.conf.blk); >> + >> + if (!blkconf_apply_backend_options(&dev->conf, read_only, >> + dev->type == TYPE_DISK, errp)) { >> + return false; >> + } >> + >> + if (blk_is_sg(lu->qdev.conf.blk)) { >> + error_setg(errp, "unwanted /dev/sg*"); >> + return false; >> + } >> + >> + blk_iostatus_enable(lu->qdev.conf.blk); >> + return true; >> +} >> + >> +static bool ufs_add_lu(UfsHc *u, UfsLu *lu, Error **errp) >> +{ >> + BlockBackend *blk = lu->qdev.conf.blk; >> + int64_t brdv_len = blk_getlength(blk); >> + uint64_t raw_dev_cap = >> + be64_to_cpu(u->geometry_desc.total_raw_device_capacity); >> + >> + if (u->device_desc.number_lu >= UFS_MAX_LUS) { >> + error_setg(errp, "ufs host controller has too many logical units."); >> + return false; >> + } >> + >> + if (u->lus[lu->lun] != NULL) { >> + error_setg(errp, "ufs logical unit %d already exists.", lu->lun); >> + return false; >> + } >> + >> + u->lus[lu->lun] = lu; >> + u->device_desc.number_lu++; >> + raw_dev_cap += (brdv_len >> UFS_GEOMETRY_CAPACITY_SHIFT); >> + u->geometry_desc.total_raw_device_capacity = cpu_to_be64(raw_dev_cap); >> + return true; >> +} >> + >> +static inline uint8_t ufs_log2(uint64_t input) >> +{ >> + int log = 1; >> + while (input >> log) { >> + log++; >> + } >> + return log; >> +} >> + >> +static void ufs_init_lu(UfsLu *lu) >> +{ >> + BlockBackend *blk = lu->qdev.conf.blk; >> + int64_t brdv_len = blk_getlength(blk); >> + >> + lu->lun = lu->qdev.lun; >> + memset(&lu->unit_desc, 0, sizeof(lu->unit_desc)); >> + lu->unit_desc.length = sizeof(UnitDescriptor); >> + lu->unit_desc.descriptor_idn = QUERY_DESC_IDN_UNIT; >> + lu->unit_desc.lu_enable = 0x01; >> + lu->unit_desc.logical_block_size = ufs_log2(lu->qdev.blocksize); >> + lu->unit_desc.unit_index = lu->qdev.lun; >> + lu->unit_desc.logical_block_count = >> + cpu_to_be64(brdv_len / (1 << lu->unit_desc.logical_block_size)); >> +} >> + >> +static bool ufs_lu_check_constraints(UfsLu *lu, Error **errp) >> +{ >> + if (!blk_is_available(lu->qdev.conf.blk)) { >> + error_setg(errp, "block backend not configured"); >> + return false; >> + } >> + >> + if (lu->qdev.channel != 0) { >> + error_setg(errp, "ufs logical unit does not support channel"); >> + return false; >> + } >> + >> + if (lu->qdev.lun >= UFS_MAX_LUS) { >> + error_setg(errp, "lun must be between 1 and %d", UFS_MAX_LUS - 1); >> + return false; >> + } >> + >> + return true; >> +} >> + >> +static void ufs_lu_realize(SCSIDevice *dev, Error **errp) >> +{ >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, dev); >> + BusState *s = qdev_get_parent_bus(&dev->qdev); >> + UfsHc *u = UFS(s->parent); >> + AioContext *ctx = NULL; >> + uint64_t nb_sectors, nb_blocks; >> + >> + if (!ufs_lu_check_constraints(lu, errp)) { >> + return; >> + } >> + >> + if (lu->qdev.conf.blk) { >> + ctx = blk_get_aio_context(lu->qdev.conf.blk); >> + aio_context_acquire(ctx); >> + if (!blkconf_blocksizes(&lu->qdev.conf, errp)) { >> + goto out; >> + } >> + } >> + lu->qdev.blocksize = lu->qdev.conf.logical_block_size; >> + blk_get_geometry(lu->qdev.conf.blk, &nb_sectors); >> + nb_blocks = nb_sectors / (lu->qdev.blocksize / BDRV_SECTOR_SIZE) - 1; >> + if (nb_blocks > UINT32_MAX) { >> + nb_blocks = UINT32_MAX; >> + } >> + lu->qdev.max_lba = nb_blocks; >> + lu->qdev.type = TYPE_DISK; >> + >> + ufs_init_lu(lu); >> + if (!ufs_add_lu(u, lu, errp)) { >> + goto out; >> + } >> + >> + ufs_lu_brdv_init(lu, errp); >> +out: >> + if (ctx) { >> + aio_context_release(ctx); >> + } >> +} >> + >> +static void ufs_lu_unrealize(SCSIDevice *dev) >> +{ >> + UfsLu *lu = DO_UPCAST(UfsLu, qdev, dev); >> + >> + blk_drain(lu->qdev.conf.blk); >> +} >> + >> +static void ufs_wlu_realize(DeviceState *qdev, Error **errp) >> +{ >> + UfsWLu *wlu = UFSWLU(qdev); >> + SCSIDevice *dev = &wlu->qdev; >> + >> + if (!is_wlun(dev->lun)) { >> + error_setg(errp, "not well-known logical unit number"); >> + return; >> + } >> + >> + QTAILQ_INIT(&dev->requests); >> +} >> + >> +static void ufs_lu_class_init(ObjectClass *oc, void *data) >> +{ >> + DeviceClass *dc = DEVICE_CLASS(oc); >> + SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(oc); >> + >> + sc->realize = ufs_lu_realize; >> + sc->unrealize = ufs_lu_unrealize; >> + sc->alloc_req = scsi_new_request; >> + dc->bus_type = TYPE_UFS_BUS; >> + device_class_set_props(dc, ufs_lu_props); >> + dc->desc = "Virtual UFS logical unit"; >> +} >> + >> +static void ufs_wlu_class_init(ObjectClass *oc, void *data) >> +{ >> + DeviceClass *dc = DEVICE_CLASS(oc); >> + SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(oc); >> + >> + /* >> + * The realize() function of TYPE_SCSI_DEVICE causes a segmentation >> fault >> + * if a block drive does not exist. Define a new realize function for >> + * well-known LUs that do not have a block drive. >> + */ >> + dc->realize = ufs_wlu_realize; >> + sc->alloc_req = scsi_new_request; >> + dc->bus_type = TYPE_UFS_BUS; >> + dc->desc = "Virtual UFS well-known logical unit"; >> +} >> + >> +static const TypeInfo ufs_lu_info = { >> + .name = TYPE_UFS_LU, >> + .parent = TYPE_SCSI_DEVICE, >> + .class_init = ufs_lu_class_init, >> + .instance_size = sizeof(UfsLu), >> +}; >> + >> +static const TypeInfo ufs_wlu_info = { >> + .name = TYPE_UFS_WLU, >> + .parent = TYPE_SCSI_DEVICE, >> + .class_init = ufs_wlu_class_init, >> + .instance_size = sizeof(UfsWLu), >> +}; >> + >> +static void ufs_lu_register_types(void) >> +{ >> + type_register_static(&ufs_lu_info); >> + type_register_static(&ufs_wlu_info); >> +} >> + >> +type_init(ufs_lu_register_types) >> diff --git a/hw/ufs/meson.build b/hw/ufs/meson.build >> index c1d90eeea6..9953b4fd9b 100644 >> --- a/hw/ufs/meson.build >> +++ b/hw/ufs/meson.build >> @@ -1 +1 @@ >> -softmmu_ss.add(when: 'CONFIG_UFS_PCI', if_true: files('ufs.c')) >> +softmmu_ss.add(when: 'CONFIG_UFS_PCI', if_true: files('ufs.c', 'lu.c')) >> diff --git a/hw/ufs/trace-events b/hw/ufs/trace-events >> index 17793929b1..644a4c60bc 100644 >> --- a/hw/ufs/trace-events >> +++ b/hw/ufs/trace-events >> @@ -12,6 +12,31 @@ ufs_exec_scsi_cmd(uint32_t slot, uint8_t lun, uint8_t >> opcode) "slot %"PRIu32", l >> ufs_exec_query_cmd(uint32_t slot, uint8_t opcode) "slot %"PRIu32", opcode >> 0x%"PRIx8"" >> ufs_process_uiccmd(uint32_t uiccmd, uint32_t ucmdarg1, uint32_t ucmdarg2, >> uint32_t ucmdarg3) "uiccmd 0x%"PRIx32", ucmdarg1 0x%"PRIx32", ucmdarg2 >> 0x%"PRIx32", ucmdarg3 0x%"PRIx32"" >> >> +# lu.c >> +ufs_scsi_check_condition(uint32_t tag, uint8_t key, uint8_t asc, uint8_t >> ascq) "Command complete tag=0x%x sense=%d/%d/%d" >> +ufs_scsi_read_complete(uint32_t tag, size_t size) "Data ready tag=0x%x >> len=%zd" >> +ufs_scsi_read_data_count(uint32_t sector_count) "Read sector_count=%d" >> +ufs_scsi_read_data_invalid(void) "Data transfer direction invalid" >> +ufs_scsi_write_complete_noio(uint32_t tag, size_t size) "Write complete >> tag=0x%x more=%zd" >> +ufs_scsi_write_data_invalid(void) "Data transfer direction invalid" >> +ufs_scsi_emulate_vpd_page_00(size_t xfer) "Inquiry EVPD[Supported pages] >> buffer size %zd" >> +ufs_scsi_emulate_vpd_page_80_not_supported(void) "Inquiry EVPD[Serial >> number] not supported" >> +ufs_scsi_emulate_vpd_page_80(size_t xfer) "Inquiry EVPD[Serial number] >> buffer size %zd" >> +ufs_scsi_emulate_vpd_page_87(size_t xfer) "Inquiry EVPD[Mode Page Policy] >> buffer size %zd" >> +ufs_scsi_emulate_mode_sense(int cmd, int page, size_t xfer, int control) >> "Mode Sense(%d) (page %d, xfer %zd, page_control %d)" >> +ufs_scsi_emulate_read_data(int buflen) "Read buf_len=%d" >> +ufs_scsi_emulate_write_data(int buflen) "Write buf_len=%d" >> +ufs_scsi_emulate_command_START_STOP(void) "START STOP UNIT" >> +ufs_scsi_emulate_command_FORMAT_UNIT(void) "FORMAT UNIT" >> +ufs_scsi_emulate_command_SEND_DIAGNOSTIC(void) "SEND DIAGNOSTIC" >> +ufs_scsi_emulate_command_SAI_16(void) "SAI READ CAPACITY(16)" >> +ufs_scsi_emulate_command_SAI_unsupported(void) "Unsupported Service Action >> In" >> +ufs_scsi_emulate_command_MODE_SELECT_10(size_t xfer) "Mode Select(10) (len >> %zd)" >> +ufs_scsi_emulate_command_VERIFY(int bytchk) "Verify (bytchk %d)" >> +ufs_scsi_emulate_command_UNKNOWN(int cmd, const char *name) "Unknown SCSI >> command (0x%2.2x=%s)" >> +ufs_scsi_dma_command_READ(uint64_t lba, uint32_t len) "Read (block %" >> PRIu64 ", count %u)" >> +ufs_scsi_dma_command_WRITE(uint64_t lba, int len) "Write (block %" PRIu64 >> ", count %u)" >> + >> # error condition >> ufs_err_memory_allocation(void) "failed to allocate memory" >> ufs_err_dma_read_utrd(uint32_t slot, uint64_t addr) "failed to read utrd. >> UTRLDBR slot %"PRIu32", UTRD dma addr %"PRIu64"" >> diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c >> index 10ecc8cd7b..d17f75446a 100644 >> --- a/hw/ufs/ufs.c >> +++ b/hw/ufs/ufs.c >> @@ -8,6 +8,19 @@ >> * This code is licensed under the GNU GPL v2 or later. >> */ >> >> +/** >> + * Reference Specs: >> https://protect2.fireeye.com/v1/url?k=eaa18e87-8b2a9bb4-eaa005c8-000babff9bb7-8dba191136b00dda&q=1&e=7e262b13-a0d3-4218-8710-562dce8a5176&u=https%3A%2F%2Fwww.jedec.org%2F, >> 3.1 >> + * >> + * Usage >> + * ----- >> + * >> + * Add options: >> + * -drive file=<file>,if=none,id=<drive_id> >> + * -device ufs,serial=<serial>,id=<bus_name>, \ >> + * nutrs=<N[optional]>,nutmrs=<N[optional]> >> + * -device ufs-lu,drive=<drive_id>,bus=<bus_name> >> + */ >> + >> #include "qemu/osdep.h" >> #include "qapi/error.h" >> #include "migration/vmstate.h" >> @@ -459,6 +472,19 @@ static const MemoryRegionOps ufs_mmio_ops = { >> }, >> }; >> >> +static QEMUSGList *ufs_get_sg_list(SCSIRequest *scsi_req) >> +{ >> + UfsRequest *req = scsi_req->hba_private; >> + return req->sg; >> +} >> + >> +static void ufs_build_upiu_sense_data(UfsRequest *req, SCSIRequest >> *scsi_req) >> +{ >> + req->rsp_upiu.sr.sense_data_len = cpu_to_be16(scsi_req->sense_len); >> + assert(scsi_req->sense_len <= SCSI_SENSE_LEN); >> + memcpy(req->rsp_upiu.sr.sense_data, scsi_req->sense, >> scsi_req->sense_len); >> +} >> + >> static void ufs_build_upiu_header(UfsRequest *req, uint8_t trans_type, >> uint8_t flags, uint8_t response, >> uint8_t scsi_status, >> @@ -472,6 +498,98 @@ static void ufs_build_upiu_header(UfsRequest *req, >> uint8_t trans_type, >> req->rsp_upiu.header.data_segment_length = >> cpu_to_be16(data_segment_length); >> } >> >> +static void ufs_scsi_command_complete(SCSIRequest *scsi_req, size_t resid) >> +{ >> + UfsRequest *req = scsi_req->hba_private; >> + int16_t status = scsi_req->status; >> + uint32_t expected_len = >> be32_to_cpu(req->req_upiu.sc.exp_data_transfer_len); >> + uint32_t transfered_len = scsi_req->cmd.xfer - resid; >> + uint8_t flags = 0, response = COMMAND_RESULT_SUCESS; >> + uint16_t data_segment_length; >> + >> + if (expected_len > transfered_len) { >> + req->rsp_upiu.sr.residual_transfer_count = >> + cpu_to_be32(expected_len - transfered_len); >> + flags |= UFS_UPIU_FLAG_UNDERFLOW; >> + } else if (expected_len < transfered_len) { >> + req->rsp_upiu.sr.residual_transfer_count = >> + cpu_to_be32(transfered_len - expected_len); >> + flags |= UFS_UPIU_FLAG_OVERFLOW; >> + } >> + >> + if (status != 0) { >> + ufs_build_upiu_sense_data(req, scsi_req); >> + response = COMMAND_RESULT_FAIL; >> + } >> + >> + data_segment_length = cpu_to_be16(scsi_req->sense_len + >> + >> sizeof(req->rsp_upiu.sr.sense_data_len)); >> + ufs_build_upiu_header(req, UPIU_TRANSACTION_RESPONSE, flags, response, >> + status, data_segment_length); >> + >> + ufs_complete_req(req, UFS_REQUEST_SUCCESS); >> + >> + scsi_req->hba_private = NULL; >> + scsi_req_unref(scsi_req); >> +} >> + >> +static const struct SCSIBusInfo ufs_scsi_info = { >> + .tcq = true, >> + .max_target = 0, >> + .max_lun = UFS_MAX_LUS, >> + .max_channel = 0, >> + >> + .get_sg_list = ufs_get_sg_list, >> + .complete = ufs_scsi_command_complete, >> +}; >> + >> +static UfsReqResult ufs_exec_scsi_cmd(UfsRequest *req) >> +{ >> + UfsHc *u = req->hc; >> + uint8_t lun = req->req_upiu.header.lun; >> + uint8_t task_tag = req->req_upiu.header.task_tag; >> + SCSIDevice *dev = NULL; >> + >> + trace_ufs_exec_scsi_cmd(req->slot, lun, req->req_upiu.sc.cdb[0]); >> + >> + if (!is_wlun(lun)) { >> + if (lun >= u->device_desc.number_lu) { >> + trace_ufs_err_scsi_cmd_invalid_lun(lun); >> + return UFS_REQUEST_ERROR; >> + } else if (u->lus[lun] == NULL) { >> + trace_ufs_err_scsi_cmd_invalid_lun(lun); >> + return UFS_REQUEST_ERROR; >> + } >> + } >> + >> + switch (lun) { >> + case UFS_UPIU_REPORT_LUNS_WLUN: >> + dev = &u->report_wlu->qdev; >> + break; >> + case UFS_UPIU_UFS_DEVICE_WLUN: >> + dev = &u->dev_wlu->qdev; >> + break; >> + case UFS_UPIU_BOOT_WLUN: >> + dev = &u->boot_wlu->qdev; >> + break; >> + case UFS_UPIU_RPMB_WLUN: >> + dev = &u->rpmb_wlu->qdev; >> + break; >> + default: >> + dev = &u->lus[lun]->qdev; >> + } >> + >> + SCSIRequest *scsi_req = scsi_req_new( >> + dev, task_tag, lun, req->req_upiu.sc.cdb, UFS_CDB_SIZE, req); >> + >> + uint32_t len = scsi_req_enqueue(scsi_req); >> + if (len) { >> + scsi_req_continue(scsi_req); >> + } >> + >> + return UFS_REQUEST_NO_COMPLETE; >> +} >> + >> static UfsReqResult ufs_exec_nop_cmd(UfsRequest *req) >> { >> trace_ufs_exec_nop_cmd(req->slot); >> @@ -749,9 +867,11 @@ static const RpmbUnitDescriptor rpmb_unit_desc = { >> >> static QueryRespCode ufs_read_unit_desc(UfsRequest *req) >> { >> + UfsHc *u = req->hc; >> uint8_t lun = req->req_upiu.qr.index; >> >> - if (lun != UFS_UPIU_RPMB_WLUN && lun > UFS_MAX_LUS) { >> + if (lun != UFS_UPIU_RPMB_WLUN && >> + (lun > UFS_MAX_LUS || u->lus[lun] == NULL)) { >> trace_ufs_err_query_invalid_index(req->req_upiu.qr.opcode, lun); >> return QUERY_RESULT_INVALID_INDEX; >> } >> @@ -759,8 +879,8 @@ static QueryRespCode ufs_read_unit_desc(UfsRequest *req) >> if (lun == UFS_UPIU_RPMB_WLUN) { >> memcpy(&req->rsp_upiu.qr.data, &rpmb_unit_desc, >> rpmb_unit_desc.length); >> } else { >> - /* unit descriptor is not yet supported */ >> - return QUERY_RESULT_INVALID_INDEX; >> + memcpy(&req->rsp_upiu.qr.data, &u->lus[lun]->unit_desc, >> + sizeof(u->lus[lun]->unit_desc)); >> } >> >> return QUERY_RESULT_SUCCESS; >> @@ -976,8 +1096,7 @@ static void ufs_exec_req(UfsRequest *req) >> req_result = ufs_exec_nop_cmd(req); >> break; >> case UPIU_TRANSACTION_COMMAND: >> - /* Not yet implemented */ >> - req_result = UFS_REQUEST_ERROR; >> + req_result = ufs_exec_scsi_cmd(req); >> break; >> case UPIU_TRANSACTION_QUERY_REQ: >> req_result = ufs_exec_query_cmd(req); >> @@ -988,7 +1107,14 @@ static void ufs_exec_req(UfsRequest *req) >> req_result = UFS_REQUEST_ERROR; >> } >> >> - ufs_complete_req(req, req_result); >> + /* >> + * The ufs_complete_req for scsi commands is handled by the >> + * ufs_scsi_command_complete() callback function. Therefore, to avoid >> + * duplicate processing, ufs_complete_req() is not called for scsi >> commands. >> + */ >> + if (req_result != UFS_REQUEST_NO_COMPLETE) { >> + ufs_complete_req(req, req_result); >> + } >> } >> >> static void ufs_process_req(void *opaque) >> @@ -1202,6 +1328,28 @@ static void ufs_init_hc(UfsHc *u) >> u->flags.permanently_disable_fw_update = 1; >> } >> >> +static bool ufs_init_wlu(UfsHc *u, UfsWLu **wlu, uint8_t wlun, Error **errp) >> +{ >> + UfsWLu *new_wlu = UFSWLU(qdev_new(TYPE_UFS_WLU)); >> + >> + qdev_prop_set_uint32(DEVICE(new_wlu), "lun", wlun); >> + >> + /* >> + * The well-known lu shares the same bus as the normal lu. If the >> well-known >> + * lu writes the same channel value as the normal lu, the report will be >> + * made not only for the normal lu but also for the well-known lu at >> + * REPORT_LUN time. To prevent this, the channel value of normal lu is >> fixed >> + * to 0 and the channel value of well-known lu is fixed to 1. >> + */ >> + qdev_prop_set_uint32(DEVICE(new_wlu), "channel", 1); >> + if (!qdev_realize_and_unref(DEVICE(new_wlu), BUS(&u->bus), errp)) { >> + return false; >> + } >> + >> + *wlu = new_wlu; >> + return true; >> +} >> + >> static void ufs_realize(PCIDevice *pci_dev, Error **errp) >> { >> UfsHc *u = UFS(pci_dev); >> @@ -1210,15 +1358,55 @@ static void ufs_realize(PCIDevice *pci_dev, Error >> **errp) >> return; >> } >> >> + qbus_init(&u->bus, sizeof(UfsBus), TYPE_UFS_BUS, &pci_dev->qdev, >> + u->parent_obj.qdev.id); >> + u->bus.parent_bus.info = &ufs_scsi_info; >> + >> ufs_init_state(u); >> ufs_init_hc(u); >> ufs_init_pci(u, pci_dev); >> + >> + if (!ufs_init_wlu(u, &u->report_wlu, UFS_UPIU_REPORT_LUNS_WLUN, errp)) { >> + return; >> + } >> + >> + if (!ufs_init_wlu(u, &u->dev_wlu, UFS_UPIU_UFS_DEVICE_WLUN, errp)) { >> + return; >> + } >> + >> + if (!ufs_init_wlu(u, &u->boot_wlu, UFS_UPIU_BOOT_WLUN, errp)) { >> + return; >> + } >> + >> + if (!ufs_init_wlu(u, &u->rpmb_wlu, UFS_UPIU_RPMB_WLUN, errp)) { >> + return; >> + } >> } >> >> static void ufs_exit(PCIDevice *pci_dev) >> { >> UfsHc *u = UFS(pci_dev); >> >> + if (u->dev_wlu) { >> + object_unref(OBJECT(u->dev_wlu)); >> + u->dev_wlu = NULL; >> + } >> + >> + if (u->report_wlu) { >> + object_unref(OBJECT(u->report_wlu)); >> + u->report_wlu = NULL; >> + } >> + >> + if (u->rpmb_wlu) { >> + object_unref(OBJECT(u->rpmb_wlu)); >> + u->rpmb_wlu = NULL; >> + } >> + >> + if (u->boot_wlu) { >> + object_unref(OBJECT(u->boot_wlu)); >> + u->boot_wlu = NULL; >> + } >> + >> qemu_bh_delete(u->doorbell_bh); >> qemu_bh_delete(u->complete_bh); >> >> @@ -1255,6 +1443,49 @@ static void ufs_class_init(ObjectClass *oc, void >> *data) >> dc->vmsd = &ufs_vmstate; >> } >> >> +static bool ufs_bus_check_address(BusState *qbus, DeviceState *qdev, >> + Error **errp) >> +{ >> + SCSIDevice *dev = SCSI_DEVICE(qdev); >> + UfsBusClass *ubc = UFS_BUS_GET_CLASS(qbus); >> + UfsHc *u = UFS(qbus->parent); >> + >> + if (strcmp(object_get_typename(OBJECT(dev)), TYPE_UFS_WLU) == 0) { >> + if (dev->lun != UFS_UPIU_REPORT_LUNS_WLUN && >> + dev->lun != UFS_UPIU_UFS_DEVICE_WLUN && >> + dev->lun != UFS_UPIU_BOOT_WLUN && dev->lun != >> UFS_UPIU_RPMB_WLUN) { >> + error_setg(errp, "bad well-known lun: %d", dev->lun); >> + return false; >> + } >> + >> + if ((dev->lun == UFS_UPIU_REPORT_LUNS_WLUN && u->report_wlu != >> NULL) || >> + (dev->lun == UFS_UPIU_UFS_DEVICE_WLUN && u->dev_wlu != NULL) || >> + (dev->lun == UFS_UPIU_BOOT_WLUN && u->boot_wlu != NULL) || >> + (dev->lun == UFS_UPIU_RPMB_WLUN && u->rpmb_wlu != NULL)) { >> + error_setg(errp, "well-known lun %d already exists", dev->lun); >> + return false; >> + } >> + >> + return true; >> + } >> + >> + if (strcmp(object_get_typename(OBJECT(dev)), TYPE_UFS_LU) != 0) { >> + error_setg(errp, "%s cannot be connected to ufs-bus", >> + object_get_typename(OBJECT(dev))); >> + return false; >> + } >> + >> + return ubc->parent_check_address(qbus, qdev, errp); >> +} >> + >> +static void ufs_bus_class_init(ObjectClass *class, void *data) >> +{ >> + BusClass *bc = BUS_CLASS(class); >> + UfsBusClass *ubc = UFS_BUS_CLASS(class); >> + ubc->parent_check_address = bc->check_address; >> + bc->check_address = ufs_bus_check_address; >> +} >> + >> static const TypeInfo ufs_info = { >> .name = TYPE_UFS, >> .parent = TYPE_PCI_DEVICE, >> @@ -1263,9 +1494,18 @@ static const TypeInfo ufs_info = { >> .interfaces = (InterfaceInfo[]){ { INTERFACE_PCIE_DEVICE }, {} }, >> }; >> >> +static const TypeInfo ufs_bus_info = { >> + .name = TYPE_UFS_BUS, >> + .parent = TYPE_SCSI_BUS, >> + .class_init = ufs_bus_class_init, >> + .class_size = sizeof(UfsBusClass), >> + .instance_size = sizeof(UfsBus), >> +}; >> + >> static void ufs_register_types(void) >> { >> type_register_static(&ufs_info); >> + type_register_static(&ufs_bus_info); >> } >> >> type_init(ufs_register_types) >> diff --git a/hw/ufs/ufs.h b/hw/ufs/ufs.h >> index 5d4fd818f9..6d2dc000e9 100644 >> --- a/hw/ufs/ufs.h >> +++ b/hw/ufs/ufs.h >> @@ -18,6 +18,18 @@ >> #define UFS_MAX_LUS 32 >> #define UFS_LOGICAL_BLK_SIZE 4096 >> >> +typedef struct UfsBusClass { >> + BusClass parent_class; >> + bool (*parent_check_address)(BusState *bus, DeviceState *dev, Error >> **errp); >> +} UfsBusClass; >> + >> +typedef struct UfsBus { >> + SCSIBus parent_bus; >> +} UfsBus; >> + >> +#define TYPE_UFS_BUS "ufs-bus" >> +DECLARE_OBJ_CHECKERS(UfsBus, UfsBusClass, UFS_BUS, TYPE_UFS_BUS) >> + >> typedef enum UfsRequestState { >> UFS_REQUEST_IDLE = 0, >> UFS_REQUEST_READY = 1, >> @@ -28,6 +40,7 @@ typedef enum UfsRequestState { >> typedef enum UfsReqResult { >> UFS_REQUEST_SUCCESS = 0, >> UFS_REQUEST_ERROR = 1, >> + UFS_REQUEST_NO_COMPLETE = 2, >> } UfsReqResult; >> >> typedef struct UfsRequest { >> @@ -43,6 +56,17 @@ typedef struct UfsRequest { >> QEMUSGList *sg; >> } UfsRequest; >> >> +typedef struct UfsLu { >> + SCSIDevice qdev; >> + uint8_t lun; >> + UnitDescriptor unit_desc; >> +} UfsLu; >> + >> +typedef struct UfsWLu { >> + SCSIDevice qdev; >> + uint8_t lun; >> +} UfsWLu; >> + >> typedef struct UfsParams { >> char *serial; >> uint8_t nutrs; /* Number of UTP Transfer Request Slots */ >> @@ -51,12 +75,18 @@ typedef struct UfsParams { >> >> typedef struct UfsHc { >> PCIDevice parent_obj; >> + UfsBus bus; >> MemoryRegion iomem; >> UfsReg reg; >> UfsParams params; >> uint32_t reg_size; >> UfsRequest *req_list; >> >> + UfsLu *lus[UFS_MAX_LUS]; >> + UfsWLu *report_wlu; >> + UfsWLu *dev_wlu; >> + UfsWLu *boot_wlu; >> + UfsWLu *rpmb_wlu; >> DeviceDescriptor device_desc; >> GeometryDescriptor geometry_desc; >> Attributes attributes; >> @@ -70,6 +100,12 @@ typedef struct UfsHc { >> #define TYPE_UFS "ufs" >> #define UFS(obj) OBJECT_CHECK(UfsHc, (obj), TYPE_UFS) >> >> +#define TYPE_UFS_LU "ufs-lu" >> +#define UFSLU(obj) OBJECT_CHECK(UfsLu, (obj), TYPE_UFS_LU) >> + >> +#define TYPE_UFS_WLU "ufs-wlu" >> +#define UFSWLU(obj) OBJECT_CHECK(UfsWLu, (obj), TYPE_UFS_WLU) >> + >> typedef enum UfsQueryFlagPerm { >> UFS_QUERY_FLAG_NONE = 0x0, >> UFS_QUERY_FLAG_READ = 0x1, >> @@ -84,4 +120,11 @@ typedef enum UfsQueryAttrPerm { >> UFS_QUERY_ATTR_WRITE = 0x2, >> } UfsQueryAttrPerm; >> >> +static inline bool is_wlun(uint8_t lun) >> +{ >> + return (lun == UFS_UPIU_REPORT_LUNS_WLUN || >> + lun == UFS_UPIU_UFS_DEVICE_WLUN || lun == UFS_UPIU_BOOT_WLUN || >> + lun == UFS_UPIU_RPMB_WLUN); >> +} >> + >> #endif /* HW_UFS_UFS_H */ >> diff --git a/include/scsi/constants.h b/include/scsi/constants.h >> index 6a8bad556a..9b98451912 100644 >> --- a/include/scsi/constants.h >> +++ b/include/scsi/constants.h >> @@ -231,6 +231,7 @@ >> #define MODE_PAGE_FLEXIBLE_DISK_GEOMETRY 0x05 >> #define MODE_PAGE_CACHING 0x08 >> #define MODE_PAGE_AUDIO_CTL 0x0e >> +#define MODE_PAGE_CONTROL 0x0a >> #define MODE_PAGE_POWER 0x1a >> #define MODE_PAGE_FAULT_FAIL 0x1c >> #define MODE_PAGE_TO_PROTECT 0x1d >> -- >> 2.34.1 >>
