1 /* 2 * QEMU UFS Logical Unit 3 * 4 * Copyright (c) 2023 Samsung Electronics Co., Ltd. All rights reserved. 5 * 6 * Written by Jeuk Kim <jeuk20.kim@samsung.com> 7 * 8 * This code is licensed under the GNU GPL v2 or later. 9 */ 10 11 #include "qemu/osdep.h" 12 #include "qemu/units.h" 13 #include "qapi/error.h" 14 #include "qemu/memalign.h" 15 #include "hw/scsi/scsi.h" 16 #include "scsi/constants.h" 17 #include "sysemu/block-backend.h" 18 #include "qemu/cutils.h" 19 #include "trace.h" 20 #include "ufs.h" 21 22 #define SCSI_COMMAND_FAIL (-1) 23 24 static void ufs_build_upiu_sense_data(UfsRequest *req, uint8_t *sense, 25 uint32_t sense_len) 26 { 27 req->rsp_upiu.sr.sense_data_len = cpu_to_be16(sense_len); 28 assert(sense_len <= SCSI_SENSE_LEN); 29 memcpy(req->rsp_upiu.sr.sense_data, sense, sense_len); 30 } 31 32 static void ufs_build_scsi_response_upiu(UfsRequest *req, uint8_t *sense, 33 uint32_t sense_len, 34 uint32_t transfered_len, 35 int16_t status) 36 { 37 uint32_t expected_len = be32_to_cpu(req->req_upiu.sc.exp_data_transfer_len); 38 uint8_t flags = 0, response = UFS_COMMAND_RESULT_SUCCESS; 39 uint16_t data_segment_length; 40 41 if (expected_len > transfered_len) { 42 req->rsp_upiu.sr.residual_transfer_count = 43 cpu_to_be32(expected_len - transfered_len); 44 flags |= UFS_UPIU_FLAG_UNDERFLOW; 45 } else if (expected_len < transfered_len) { 46 req->rsp_upiu.sr.residual_transfer_count = 47 cpu_to_be32(transfered_len - expected_len); 48 flags |= UFS_UPIU_FLAG_OVERFLOW; 49 } 50 51 if (status != 0) { 52 ufs_build_upiu_sense_data(req, sense, sense_len); 53 response = UFS_COMMAND_RESULT_FAIL; 54 } 55 56 data_segment_length = 57 cpu_to_be16(sense_len + sizeof(req->rsp_upiu.sr.sense_data_len)); 58 ufs_build_upiu_header(req, UFS_UPIU_TRANSACTION_RESPONSE, flags, response, 59 status, data_segment_length); 60 } 61 62 static void ufs_scsi_command_complete(SCSIRequest *scsi_req, size_t resid) 63 { 64 UfsRequest *req = scsi_req->hba_private; 65 int16_t status = scsi_req->status; 66 67 uint32_t transfered_len = scsi_req->cmd.xfer - resid; 68 69 ufs_build_scsi_response_upiu(req, scsi_req->sense, scsi_req->sense_len, 70 transfered_len, status); 71 72 ufs_complete_req(req, UFS_REQUEST_SUCCESS); 73 74 scsi_req->hba_private = NULL; 75 scsi_req_unref(scsi_req); 76 } 77 78 static QEMUSGList *ufs_get_sg_list(SCSIRequest *scsi_req) 79 { 80 UfsRequest *req = scsi_req->hba_private; 81 return req->sg; 82 } 83 84 static const struct SCSIBusInfo ufs_scsi_info = { 85 .tcq = true, 86 .max_target = 0, 87 .max_lun = UFS_MAX_LUS, 88 .max_channel = 0, 89 90 .get_sg_list = ufs_get_sg_list, 91 .complete = ufs_scsi_command_complete, 92 }; 93 94 static int ufs_emulate_report_luns(UfsRequest *req, uint8_t *outbuf, 95 uint32_t outbuf_len) 96 { 97 UfsHc *u = req->hc; 98 int len = 0; 99 100 /* TODO: Support for cases where SELECT REPORT is 1 and 2 */ 101 if (req->req_upiu.sc.cdb[2] != 0) { 102 return SCSI_COMMAND_FAIL; 103 } 104 105 len += 8; 106 107 for (uint8_t lun = 0; lun < UFS_MAX_LUS; ++lun) { 108 if (u->lus[lun]) { 109 if (len + 8 > outbuf_len) { 110 break; 111 } 112 113 memset(outbuf + len, 0, 8); 114 outbuf[len] = 0; 115 outbuf[len + 1] = lun; 116 len += 8; 117 } 118 } 119 120 /* store the LUN list length */ 121 stl_be_p(outbuf, len - 8); 122 123 return len; 124 } 125 126 static int ufs_scsi_emulate_vpd_page(UfsRequest *req, uint8_t *outbuf, 127 uint32_t outbuf_len) 128 { 129 uint8_t page_code = req->req_upiu.sc.cdb[2]; 130 int start, buflen = 0; 131 132 outbuf[buflen++] = TYPE_WLUN; 133 outbuf[buflen++] = page_code; 134 outbuf[buflen++] = 0x00; 135 outbuf[buflen++] = 0x00; 136 start = buflen; 137 138 switch (page_code) { 139 case 0x00: /* Supported page codes, mandatory */ 140 { 141 outbuf[buflen++] = 0x00; /* list of supported pages (this page) */ 142 outbuf[buflen++] = 0x87; /* mode page policy */ 143 break; 144 } 145 case 0x87: /* Mode Page Policy, mandatory */ 146 { 147 outbuf[buflen++] = 0x3f; /* apply to all mode pages and subpages */ 148 outbuf[buflen++] = 0xff; 149 outbuf[buflen++] = 0; /* shared */ 150 outbuf[buflen++] = 0; 151 break; 152 } 153 default: 154 return SCSI_COMMAND_FAIL; 155 } 156 /* done with EVPD */ 157 assert(buflen - start <= 255); 158 outbuf[start - 1] = buflen - start; 159 return buflen; 160 } 161 162 static int ufs_emulate_wlun_inquiry(UfsRequest *req, uint8_t *outbuf, 163 uint32_t outbuf_len) 164 { 165 if (outbuf_len < SCSI_INQUIRY_LEN) { 166 return 0; 167 } 168 169 if (req->req_upiu.sc.cdb[1] & 0x1) { 170 /* Vital product data */ 171 return ufs_scsi_emulate_vpd_page(req, outbuf, outbuf_len); 172 } 173 174 /* Standard INQUIRY data */ 175 if (req->req_upiu.sc.cdb[2] != 0) { 176 return SCSI_COMMAND_FAIL; 177 } 178 179 outbuf[0] = TYPE_WLUN; 180 outbuf[1] = 0; 181 outbuf[2] = 0x6; /* SPC-4 */ 182 outbuf[3] = 0x2; 183 outbuf[4] = 31; 184 outbuf[5] = 0; 185 outbuf[6] = 0; 186 outbuf[7] = 0x2; 187 strpadcpy((char *)&outbuf[8], 8, "QEMU", ' '); 188 strpadcpy((char *)&outbuf[16], 16, "QEMU UFS", ' '); 189 memset(&outbuf[32], 0, 4); 190 191 return SCSI_INQUIRY_LEN; 192 } 193 194 static UfsReqResult ufs_emulate_scsi_cmd(UfsLu *lu, UfsRequest *req) 195 { 196 uint8_t lun = lu->lun; 197 uint8_t outbuf[4096]; 198 uint8_t sense_buf[UFS_SENSE_SIZE]; 199 uint8_t scsi_status; 200 int len = 0; 201 202 switch (req->req_upiu.sc.cdb[0]) { 203 case REPORT_LUNS: 204 len = ufs_emulate_report_luns(req, outbuf, sizeof(outbuf)); 205 if (len == SCSI_COMMAND_FAIL) { 206 scsi_build_sense(sense_buf, SENSE_CODE(INVALID_FIELD)); 207 scsi_status = CHECK_CONDITION; 208 } else { 209 scsi_status = GOOD; 210 } 211 break; 212 case INQUIRY: 213 len = ufs_emulate_wlun_inquiry(req, outbuf, sizeof(outbuf)); 214 if (len == SCSI_COMMAND_FAIL) { 215 scsi_build_sense(sense_buf, SENSE_CODE(INVALID_FIELD)); 216 scsi_status = CHECK_CONDITION; 217 } else { 218 scsi_status = GOOD; 219 } 220 break; 221 case REQUEST_SENSE: 222 /* Just return no sense data */ 223 len = scsi_build_sense_buf(outbuf, sizeof(outbuf), SENSE_CODE(NO_SENSE), 224 true); 225 scsi_status = GOOD; 226 break; 227 case START_STOP: 228 /* TODO: Revisit it when Power Management is implemented */ 229 if (lun == UFS_UPIU_UFS_DEVICE_WLUN) { 230 scsi_status = GOOD; 231 break; 232 } 233 /* fallthrough */ 234 default: 235 scsi_build_sense(sense_buf, SENSE_CODE(INVALID_OPCODE)); 236 scsi_status = CHECK_CONDITION; 237 } 238 239 len = MIN(len, (int)req->data_len); 240 if (scsi_status == GOOD && len > 0 && 241 dma_buf_read(outbuf, len, NULL, req->sg, MEMTXATTRS_UNSPECIFIED) != 242 MEMTX_OK) { 243 return UFS_REQUEST_FAIL; 244 } 245 246 ufs_build_scsi_response_upiu(req, sense_buf, sizeof(sense_buf), len, 247 scsi_status); 248 return UFS_REQUEST_SUCCESS; 249 } 250 251 static UfsReqResult ufs_process_scsi_cmd(UfsLu *lu, UfsRequest *req) 252 { 253 uint8_t task_tag = req->req_upiu.header.task_tag; 254 255 /* 256 * Each ufs-lu has its own independent virtual SCSI bus. Therefore, we can't 257 * use scsi_target_emulate_report_luns() which gets all lu information over 258 * the SCSI bus. Therefore, we use ufs_emulate_scsi_cmd() like the 259 * well-known lu. 260 */ 261 if (req->req_upiu.sc.cdb[0] == REPORT_LUNS) { 262 return ufs_emulate_scsi_cmd(lu, req); 263 } 264 265 SCSIRequest *scsi_req = 266 scsi_req_new(lu->scsi_dev, task_tag, lu->lun, req->req_upiu.sc.cdb, 267 UFS_CDB_SIZE, req); 268 269 uint32_t len = scsi_req_enqueue(scsi_req); 270 if (len) { 271 scsi_req_continue(scsi_req); 272 } 273 274 return UFS_REQUEST_NO_COMPLETE; 275 } 276 277 static Property ufs_lu_props[] = { 278 DEFINE_PROP_DRIVE("drive", UfsLu, conf.blk), 279 DEFINE_PROP_UINT8("lun", UfsLu, lun, 0), 280 DEFINE_PROP_END_OF_LIST(), 281 }; 282 283 static bool ufs_add_lu(UfsHc *u, UfsLu *lu, Error **errp) 284 { 285 BlockBackend *blk = lu->conf.blk; 286 int64_t brdv_len = blk_getlength(blk); 287 uint64_t raw_dev_cap = 288 be64_to_cpu(u->geometry_desc.total_raw_device_capacity); 289 290 if (u->device_desc.number_lu >= UFS_MAX_LUS) { 291 error_setg(errp, "ufs host controller has too many logical units."); 292 return false; 293 } 294 295 if (u->lus[lu->lun] != NULL) { 296 error_setg(errp, "ufs logical unit %d already exists.", lu->lun); 297 return false; 298 } 299 300 u->lus[lu->lun] = lu; 301 u->device_desc.number_lu++; 302 raw_dev_cap += (brdv_len >> UFS_GEOMETRY_CAPACITY_SHIFT); 303 u->geometry_desc.total_raw_device_capacity = cpu_to_be64(raw_dev_cap); 304 return true; 305 } 306 307 void ufs_init_wlu(UfsLu *wlu, uint8_t wlun) 308 { 309 wlu->lun = wlun; 310 wlu->scsi_op = &ufs_emulate_scsi_cmd; 311 } 312 313 static void ufs_init_lu(UfsLu *lu) 314 { 315 BlockBackend *blk = lu->conf.blk; 316 int64_t brdv_len = blk_getlength(blk); 317 318 memset(&lu->unit_desc, 0, sizeof(lu->unit_desc)); 319 lu->unit_desc.length = sizeof(UnitDescriptor); 320 lu->unit_desc.descriptor_idn = UFS_QUERY_DESC_IDN_UNIT; 321 lu->unit_desc.lu_enable = 0x01; 322 lu->unit_desc.logical_block_size = UFS_BLOCK_SIZE_SHIFT; 323 lu->unit_desc.unit_index = lu->lun; 324 lu->unit_desc.logical_block_count = 325 cpu_to_be64(brdv_len / (1 << lu->unit_desc.logical_block_size)); 326 327 lu->scsi_op = &ufs_process_scsi_cmd; 328 } 329 330 static bool ufs_lu_check_constraints(UfsLu *lu, Error **errp) 331 { 332 if (!lu->conf.blk) { 333 error_setg(errp, "drive property not set"); 334 return false; 335 } 336 337 if (lu->lun >= UFS_MAX_LUS) { 338 error_setg(errp, "lun must be between 0 and %d", UFS_MAX_LUS - 1); 339 return false; 340 } 341 342 return true; 343 } 344 345 static void ufs_init_scsi_device(UfsLu *lu, BlockBackend *blk, Error **errp) 346 { 347 DeviceState *scsi_dev; 348 349 scsi_bus_init(&lu->bus, sizeof(lu->bus), DEVICE(lu), &ufs_scsi_info); 350 351 blk_ref(blk); 352 blk_detach_dev(blk, DEVICE(lu)); 353 lu->conf.blk = NULL; 354 355 /* 356 * The ufs-lu is the device that is wrapping the scsi-hd. It owns a virtual 357 * SCSI bus that serves the scsi-hd. 358 */ 359 scsi_dev = qdev_new("scsi-hd"); 360 object_property_add_child(OBJECT(&lu->bus), "ufs-scsi", OBJECT(scsi_dev)); 361 362 qdev_prop_set_uint32(scsi_dev, "physical_block_size", UFS_BLOCK_SIZE); 363 qdev_prop_set_uint32(scsi_dev, "logical_block_size", UFS_BLOCK_SIZE); 364 qdev_prop_set_uint32(scsi_dev, "scsi-id", 0); 365 qdev_prop_set_uint32(scsi_dev, "lun", lu->lun); 366 if (!qdev_prop_set_drive_err(scsi_dev, "drive", blk, errp)) { 367 object_unparent(OBJECT(scsi_dev)); 368 return; 369 } 370 371 if (!qdev_realize_and_unref(scsi_dev, &lu->bus.qbus, errp)) { 372 object_unparent(OBJECT(scsi_dev)); 373 return; 374 } 375 376 blk_unref(blk); 377 lu->scsi_dev = SCSI_DEVICE(scsi_dev); 378 } 379 380 static void ufs_lu_realize(DeviceState *dev, Error **errp) 381 { 382 UfsLu *lu = DO_UPCAST(UfsLu, qdev, dev); 383 BusState *s = qdev_get_parent_bus(dev); 384 UfsHc *u = UFS(s->parent); 385 BlockBackend *blk = lu->conf.blk; 386 387 if (!ufs_lu_check_constraints(lu, errp)) { 388 return; 389 } 390 391 if (!blk) { 392 error_setg(errp, "drive property not set"); 393 return; 394 } 395 396 if (!blkconf_blocksizes(&lu->conf, errp)) { 397 return; 398 } 399 400 if (!blkconf_apply_backend_options(&lu->conf, !blk_supports_write_perm(blk), 401 true, errp)) { 402 return; 403 } 404 405 ufs_init_lu(lu); 406 if (!ufs_add_lu(u, lu, errp)) { 407 return; 408 } 409 410 ufs_init_scsi_device(lu, blk, errp); 411 } 412 413 static void ufs_lu_unrealize(DeviceState *dev) 414 { 415 UfsLu *lu = DO_UPCAST(UfsLu, qdev, dev); 416 417 if (lu->scsi_dev) { 418 object_unref(OBJECT(lu->scsi_dev)); 419 lu->scsi_dev = NULL; 420 } 421 } 422 423 static void ufs_lu_class_init(ObjectClass *oc, void *data) 424 { 425 DeviceClass *dc = DEVICE_CLASS(oc); 426 427 dc->realize = ufs_lu_realize; 428 dc->unrealize = ufs_lu_unrealize; 429 dc->bus_type = TYPE_UFS_BUS; 430 device_class_set_props(dc, ufs_lu_props); 431 dc->desc = "Virtual UFS logical unit"; 432 } 433 434 static const TypeInfo ufs_lu_info = { 435 .name = TYPE_UFS_LU, 436 .parent = TYPE_DEVICE, 437 .class_init = ufs_lu_class_init, 438 .instance_size = sizeof(UfsLu), 439 }; 440 441 static void ufs_lu_register_types(void) 442 { 443 type_register_static(&ufs_lu_info); 444 } 445 446 type_init(ufs_lu_register_types) 447