master
c 559 lines 15.4 KB
Raw
1 /*
2 * QEMU UFS Logical Unit
3 *
4 * Copyright (c) 2023 Samsung Electronics Co., Ltd. All rights reserved.
5 *
6 * Written by Jeuk Kim <jeuk20.kim@samsung.com>
7 *
8 * This code is licensed under the GNU GPL v2 or later.
9 */
10
11 #include "qemu/osdep.h"
12 #include "qemu/units.h"
13 #include "qapi/error.h"
14 #include "qemu/memalign.h"
15 #include "hw/scsi/scsi.h"
16 #include "scsi/constants.h"
17 #include "system/block-backend.h"
18 #include "qemu/cutils.h"
19 #include "trace.h"
20 #include "ufs.h"
21
22 #define SCSI_COMMAND_FAIL (-1)
23
24 static void ufs_build_upiu_sense_data(UfsRequest *req, uint8_t *sense,
25 uint32_t sense_len)
26 {
27 req->rsp_upiu.sr.sense_data_len = cpu_to_be16(sense_len);
28 assert(sense_len <= SCSI_SENSE_LEN);
29 memcpy(req->rsp_upiu.sr.sense_data, sense, sense_len);
30 }
31
32 static void ufs_build_scsi_response_upiu(UfsRequest *req, uint8_t *sense,
33 uint32_t sense_len,
34 uint32_t transfered_len,
35 int16_t status)
36 {
37 uint32_t expected_len = be32_to_cpu(req->req_upiu.sc.exp_data_transfer_len);
38 uint8_t flags = 0, response = UFS_COMMAND_RESULT_SUCCESS;
39 uint16_t data_segment_length;
40
41 if (expected_len > transfered_len) {
42 req->rsp_upiu.sr.residual_transfer_count =
43 cpu_to_be32(expected_len - transfered_len);
44 flags |= UFS_UPIU_FLAG_UNDERFLOW;
45 } else if (expected_len < transfered_len) {
46 req->rsp_upiu.sr.residual_transfer_count =
47 cpu_to_be32(transfered_len - expected_len);
48 flags |= UFS_UPIU_FLAG_OVERFLOW;
49 }
50
51 if (status != 0) {
52 ufs_build_upiu_sense_data(req, sense, sense_len);
53 response = UFS_COMMAND_RESULT_FAIL;
54 }
55
56 data_segment_length = sense_len + sizeof(req->rsp_upiu.sr.sense_data_len);
57 ufs_build_upiu_header(req, UFS_UPIU_TRANSACTION_RESPONSE, flags, response,
58 status, data_segment_length);
59 }
60
61 #define UFS_GROUP_NUMBER_MASK 0x1F
62 #define UFS_WB_GROUP_NUMBER_DEFAULT 0x00 /* 00000b */
63 #define UFS_WB_GROUP_NUMBER_PINNED 0x18 /* 11000b */
64 static bool ufs_wb_check_write_pinned(UfsHc *u, UfsRequest *req)
65 {
66 uint8_t cmd = req->req_upiu.sc.cdb[0];
67 uint8_t group_number = UFS_WB_GROUP_NUMBER_DEFAULT;
68
69 if (u->attributes.wb_buffer_partial_flush_mode != UFS_WB_FLUSH_PINNED) {
70 return false;
71 }
72
73 if (cmd == WRITE_16) {
74 group_number = req->req_upiu.sc.cdb[14] & UFS_GROUP_NUMBER_MASK;
75
76 } else if (cmd == WRITE_10) {
77 group_number = req->req_upiu.sc.cdb[6] & UFS_GROUP_NUMBER_MASK;
78 }
79
80 return (group_number == UFS_WB_GROUP_NUMBER_PINNED);
81 }
82
83 static void ufs_wb_process_write_normal(UfsHc *u, uint32_t transfered_len)
84 {
85 UfsWb *wb = &u->wb;
86 uint64_t curr_bytes, used_bytes, remain_bytes;
87
88 if (!wb->curr_bytes) {
89 return;
90 }
91
92 curr_bytes = wb->curr_bytes - wb->pinned_curr_bytes;
93 used_bytes = wb->used_bytes - wb->pinned_used_bytes;
94
95 if (used_bytes >= curr_bytes) {
96 return;
97 }
98
99 remain_bytes = curr_bytes - used_bytes;
100 wb->used_bytes += MIN(remain_bytes, transfered_len);
101 }
102
103 #define UFS_WB_TOTAL_WRITTEN_DIV (10 * 1024 * 1024) /* 10MiB */
104 static void ufs_wb_process_write_pinned(UfsHc *u, uint32_t transfered_len)
105 {
106 UfsWb *wb = &u->wb;
107 uint64_t remain_bytes, remain_data;
108 uint32_t total_written;
109
110 if (!wb->pinned_curr_bytes) {
111 ufs_wb_process_write_normal(u, transfered_len);
112 return;
113 }
114
115 if (wb->pinned_used_bytes >= wb->pinned_curr_bytes) {
116 ufs_wb_process_write_normal(u, transfered_len);
117 return;
118 }
119
120 remain_bytes = wb->pinned_curr_bytes - wb->pinned_used_bytes;
121 if (remain_bytes >= transfered_len) {
122 wb->pinned_total_written_bytes += transfered_len;
123 wb->pinned_used_bytes += transfered_len;
124 wb->used_bytes += transfered_len;
125 remain_data = 0;
126
127 } else {
128 wb->pinned_total_written_bytes += remain_bytes;
129 wb->pinned_used_bytes += remain_bytes;
130 wb->used_bytes += remain_bytes;
131 remain_data = transfered_len - remain_bytes;
132 }
133
134 total_written = wb->pinned_total_written_bytes / UFS_WB_TOTAL_WRITTEN_DIV;
135 u->attributes.pinned_wb_cumm_written_size = cpu_to_be32(total_written);
136
137 ufs_wb_process_write_normal(u, remain_data);
138 }
139
140 static void ufs_wb_process_write_req(UfsRequest *req, uint32_t transfered_len)
141 {
142 UfsHc *u = req->hc;
143
144 if (!u->flags.wb_en || !ufs_is_write_req(req)) {
145 return;
146 }
147
148 if (ufs_wb_check_write_pinned(u, req)) {
149 ufs_wb_process_write_pinned(u, transfered_len);
150 } else {
151 ufs_wb_process_write_normal(u, transfered_len);
152 }
153
154 ufs_wb_update_avail_buffer(u);
155 }
156
157 #define UFS_HID_MAX_FRAGMENTS 1024
158 static void ufs_hid_count_fragments(UfsRequest *req)
159 {
160 UfsHc *u = req->hc;
161
162 if (!ufs_is_write_req(req)) {
163 return;
164 }
165
166 u->hid_fragment_count =
167 MIN(u->hid_fragment_count + 1, UFS_HID_MAX_FRAGMENTS);
168 }
169
170 static void ufs_scsi_command_complete(SCSIRequest *scsi_req, size_t resid)
171 {
172 UfsRequest *req = scsi_req->hba_private;
173 int16_t status = scsi_req->status;
174 uint32_t transfered_len = scsi_req->cmd.xfer - resid;
175
176 /* WB / HID accounting should only happen for successful commands */
177 if (status == GOOD) {
178 ufs_wb_process_write_req(req, transfered_len);
179 ufs_hid_count_fragments(req);
180 }
181
182 ufs_build_scsi_response_upiu(req, scsi_req->sense, scsi_req->sense_len,
183 transfered_len, status);
184
185 ufs_complete_req(req, UFS_REQUEST_SUCCESS);
186
187 scsi_req->hba_private = NULL;
188 scsi_req_unref(scsi_req);
189 }
190
191 static QEMUSGList *ufs_get_sg_list(SCSIRequest *scsi_req)
192 {
193 UfsRequest *req = scsi_req->hba_private;
194 return req->sg;
195 }
196
197 static const struct SCSIBusInfo ufs_scsi_info = {
198 .tcq = true,
199 .max_target = 0,
200 .max_lun = UFS_MAX_LUS,
201 .max_channel = 0,
202
203 .get_sg_list = ufs_get_sg_list,
204 .complete = ufs_scsi_command_complete,
205 };
206
207 static int ufs_emulate_report_luns(UfsRequest *req, uint8_t *outbuf,
208 uint32_t outbuf_len)
209 {
210 UfsHc *u = req->hc;
211 int len = 0;
212
213 /* TODO: Support for cases where SELECT REPORT is 1 and 2 */
214 if (req->req_upiu.sc.cdb[2] != 0) {
215 return SCSI_COMMAND_FAIL;
216 }
217
218 if (outbuf_len < 8) {
219 return SCSI_COMMAND_FAIL;
220 }
221 memset(outbuf, 0, 8);
222 len += 8;
223
224 for (uint8_t lun = 0; lun < UFS_MAX_LUS; ++lun) {
225 if (u->lus[lun]) {
226 if (len + 8 > outbuf_len) {
227 break;
228 }
229
230 memset(outbuf + len, 0, 8);
231 outbuf[len] = 0;
232 outbuf[len + 1] = lun;
233 len += 8;
234 }
235 }
236
237 /* store the LUN list length */
238 stl_be_p(outbuf, len - 8);
239
240 return len;
241 }
242
243 static int ufs_scsi_emulate_vpd_page(UfsRequest *req, uint8_t *outbuf,
244 uint32_t outbuf_len)
245 {
246 uint8_t page_code = req->req_upiu.sc.cdb[2];
247 int start, buflen = 0;
248
249 outbuf[buflen++] = TYPE_WLUN;
250 outbuf[buflen++] = page_code;
251 outbuf[buflen++] = 0x00;
252 outbuf[buflen++] = 0x00;
253 start = buflen;
254
255 switch (page_code) {
256 case 0x00: /* Supported page codes, mandatory */
257 {
258 outbuf[buflen++] = 0x00; /* list of supported pages (this page) */
259 outbuf[buflen++] = 0x87; /* mode page policy */
260 break;
261 }
262 case 0x87: /* Mode Page Policy, mandatory */
263 {
264 outbuf[buflen++] = 0x3f; /* apply to all mode pages and subpages */
265 outbuf[buflen++] = 0xff;
266 outbuf[buflen++] = 0; /* shared */
267 outbuf[buflen++] = 0;
268 break;
269 }
270 default:
271 return SCSI_COMMAND_FAIL;
272 }
273 /* done with EVPD */
274 assert(buflen - start <= 255);
275 outbuf[start - 1] = buflen - start;
276 return buflen;
277 }
278
279 static int ufs_emulate_wlun_inquiry(UfsRequest *req, uint8_t *outbuf,
280 uint32_t outbuf_len)
281 {
282 if (outbuf_len < SCSI_INQUIRY_LEN) {
283 return 0;
284 }
285
286 if (req->req_upiu.sc.cdb[1] & 0x1) {
287 /* Vital product data */
288 return ufs_scsi_emulate_vpd_page(req, outbuf, outbuf_len);
289 }
290
291 /* Standard INQUIRY data */
292 if (req->req_upiu.sc.cdb[2] != 0) {
293 return SCSI_COMMAND_FAIL;
294 }
295
296 outbuf[0] = TYPE_WLUN;
297 outbuf[1] = 0;
298 outbuf[2] = 0x6; /* SPC-4 */
299 outbuf[3] = 0x2;
300 outbuf[4] = 31;
301 outbuf[5] = 0;
302 outbuf[6] = 0;
303 outbuf[7] = 0x2;
304 strpadcpy((char *)&outbuf[8], 8, "QEMU", ' ');
305 strpadcpy((char *)&outbuf[16], 16, "QEMU UFS", ' ');
306 memset(&outbuf[32], 0, 4);
307
308 return SCSI_INQUIRY_LEN;
309 }
310
311 static UfsReqResult ufs_emulate_scsi_cmd(UfsLu *lu, UfsRequest *req)
312 {
313 uint8_t lun = lu->lun;
314 QEMU_UNINITIALIZED uint8_t outbuf[4096];
315 uint8_t sense_buf[UFS_SENSE_SIZE];
316 uint8_t scsi_status;
317 int len = 0;
318
319 switch (req->req_upiu.sc.cdb[0]) {
320 case REPORT_LUNS:
321 len = ufs_emulate_report_luns(req, outbuf, sizeof(outbuf));
322 if (len == SCSI_COMMAND_FAIL) {
323 scsi_build_sense(sense_buf, SENSE_CODE(INVALID_FIELD));
324 scsi_status = CHECK_CONDITION;
325 } else {
326 scsi_status = GOOD;
327 }
328 break;
329 case INQUIRY:
330 len = ufs_emulate_wlun_inquiry(req, outbuf, sizeof(outbuf));
331 if (len == SCSI_COMMAND_FAIL) {
332 scsi_build_sense(sense_buf, SENSE_CODE(INVALID_FIELD));
333 scsi_status = CHECK_CONDITION;
334 } else {
335 scsi_status = GOOD;
336 }
337 break;
338 case REQUEST_SENSE:
339 /* Just return no sense data */
340 len = scsi_build_sense_buf(outbuf, sizeof(outbuf), SENSE_CODE(NO_SENSE),
341 true);
342 scsi_status = GOOD;
343 break;
344 case START_STOP:
345 /* TODO: Revisit it when Power Management is implemented */
346 if (lun == UFS_UPIU_UFS_DEVICE_WLUN) {
347 scsi_status = GOOD;
348 break;
349 }
350 /* fallthrough */
351 default:
352 scsi_build_sense(sense_buf, SENSE_CODE(INVALID_OPCODE));
353 scsi_status = CHECK_CONDITION;
354 }
355
356 len = MIN(len, (int)req->data_len);
357 if (scsi_status == GOOD && len > 0 &&
358 dma_buf_read(outbuf, len, NULL, req->sg, MEMTXATTRS_UNSPECIFIED) !=
359 MEMTX_OK) {
360 return UFS_REQUEST_FAIL;
361 }
362
363 ufs_build_scsi_response_upiu(req, sense_buf, sizeof(sense_buf), len,
364 scsi_status);
365 return UFS_REQUEST_SUCCESS;
366 }
367
368 static UfsReqResult ufs_process_scsi_cmd(UfsLu *lu, UfsRequest *req)
369 {
370 uint8_t task_tag = req->req_upiu.header.task_tag;
371
372 /*
373 * Each ufs-lu has its own independent virtual SCSI bus. Therefore, we can't
374 * use scsi_target_emulate_report_luns() which gets all lu information over
375 * the SCSI bus. Therefore, we use ufs_emulate_scsi_cmd() like the
376 * well-known lu.
377 */
378 if (req->req_upiu.sc.cdb[0] == REPORT_LUNS) {
379 return ufs_emulate_scsi_cmd(lu, req);
380 }
381
382 SCSIRequest *scsi_req =
383 scsi_req_new(lu->scsi_dev, task_tag, lu->lun, req->req_upiu.sc.cdb,
384 UFS_CDB_SIZE, req);
385
386 uint32_t len = scsi_req_enqueue(scsi_req);
387 if (len) {
388 scsi_req_continue(scsi_req);
389 }
390
391 return UFS_REQUEST_NO_COMPLETE;
392 }
393
394 static const Property ufs_lu_props[] = {
395 DEFINE_PROP_DRIVE("drive", UfsLu, conf.blk),
396 DEFINE_PROP_UINT8("lun", UfsLu, lun, 0),
397 };
398
399 static bool ufs_add_lu(UfsHc *u, UfsLu *lu, Error **errp)
400 {
401 BlockBackend *blk = lu->conf.blk;
402 int64_t brdv_len = blk_getlength(blk);
403 uint64_t raw_dev_cap =
404 be64_to_cpu(u->geometry_desc.total_raw_device_capacity);
405
406 if (u->device_desc.number_lu >= UFS_MAX_LUS) {
407 error_setg(errp, "ufs host controller has too many logical units.");
408 return false;
409 }
410
411 if (u->lus[lu->lun] != NULL) {
412 error_setg(errp, "ufs logical unit %d already exists.", lu->lun);
413 return false;
414 }
415
416 u->lus[lu->lun] = lu;
417 u->device_desc.number_lu++;
418 raw_dev_cap += (brdv_len >> UFS_GEOMETRY_CAPACITY_SHIFT);
419 u->geometry_desc.total_raw_device_capacity = cpu_to_be64(raw_dev_cap);
420 return true;
421 }
422
423 void ufs_init_wlu(UfsLu *wlu, uint8_t wlun)
424 {
425 wlu->lun = wlun;
426 wlu->scsi_op = &ufs_emulate_scsi_cmd;
427 }
428
429 static void ufs_init_lu(UfsLu *lu)
430 {
431 BlockBackend *blk = lu->conf.blk;
432 int64_t brdv_len = blk_getlength(blk);
433
434 memset(&lu->unit_desc, 0, sizeof(lu->unit_desc));
435 lu->unit_desc.length = sizeof(UnitDescriptor);
436 lu->unit_desc.descriptor_idn = UFS_QUERY_DESC_IDN_UNIT;
437 lu->unit_desc.lu_enable = 0x01;
438 lu->unit_desc.logical_block_size = UFS_BLOCK_SIZE_SHIFT;
439 lu->unit_desc.unit_index = lu->lun;
440 lu->unit_desc.logical_block_count =
441 cpu_to_be64(brdv_len / (1 << lu->unit_desc.logical_block_size));
442
443 lu->scsi_op = &ufs_process_scsi_cmd;
444 }
445
446 static bool ufs_lu_check_constraints(UfsLu *lu, Error **errp)
447 {
448 if (!lu->conf.blk) {
449 error_setg(errp, "drive property not set");
450 return false;
451 }
452
453 if (lu->lun >= UFS_MAX_LUS) {
454 error_setg(errp, "lun must be between 0 and %d", UFS_MAX_LUS - 1);
455 return false;
456 }
457
458 return true;
459 }
460
461 static void ufs_init_scsi_device(UfsLu *lu, BlockBackend *blk, Error **errp)
462 {
463 DeviceState *scsi_dev;
464
465 scsi_bus_init(&lu->bus, sizeof(lu->bus), DEVICE(lu), &ufs_scsi_info);
466
467 blk_ref(blk);
468 blk_detach_dev(blk, DEVICE(lu));
469 lu->conf.blk = NULL;
470
471 /*
472 * The ufs-lu is the device that is wrapping the scsi-hd. It owns a virtual
473 * SCSI bus that serves the scsi-hd.
474 */
475 scsi_dev = qdev_new("scsi-hd");
476 object_property_add_child(OBJECT(&lu->bus), "ufs-scsi", OBJECT(scsi_dev));
477
478 qdev_prop_set_uint32(scsi_dev, "physical_block_size", UFS_BLOCK_SIZE);
479 qdev_prop_set_uint32(scsi_dev, "logical_block_size", UFS_BLOCK_SIZE);
480 qdev_prop_set_uint32(scsi_dev, "scsi-id", 0);
481 qdev_prop_set_uint32(scsi_dev, "lun", lu->lun);
482 if (!qdev_prop_set_drive_err(scsi_dev, "drive", blk, errp)) {
483 object_unparent(OBJECT(scsi_dev));
484 return;
485 }
486
487 if (!qdev_realize_and_unref(scsi_dev, &lu->bus.qbus, errp)) {
488 object_unparent(OBJECT(scsi_dev));
489 return;
490 }
491
492 blk_unref(blk);
493 lu->scsi_dev = SCSI_DEVICE(scsi_dev);
494 }
495
496 static void ufs_lu_realize(DeviceState *dev, Error **errp)
497 {
498 UfsLu *lu = DO_UPCAST(UfsLu, qdev, dev);
499 BusState *s = qdev_get_parent_bus(dev);
500 UfsHc *u = UFS_BUS(s)->hc;
501 BlockBackend *blk = lu->conf.blk;
502
503 if (!ufs_lu_check_constraints(lu, errp)) {
504 return;
505 }
506
507 if (!blk) {
508 error_setg(errp, "drive property not set");
509 return;
510 }
511
512 if (!blkconf_blocksizes(&lu->conf, errp)) {
513 return;
514 }
515
516 if (!blkconf_apply_backend_options(&lu->conf, !blk_supports_write_perm(blk),
517 true, errp)) {
518 return;
519 }
520
521 ufs_init_lu(lu);
522 if (!ufs_add_lu(u, lu, errp)) {
523 return;
524 }
525
526 ufs_init_scsi_device(lu, blk, errp);
527 }
528
529 static void ufs_lu_unrealize(DeviceState *dev)
530 {
531 UfsLu *lu = DO_UPCAST(UfsLu, qdev, dev);
532
533 lu->scsi_dev = NULL;
534 }
535
536 static void ufs_lu_class_init(ObjectClass *oc, const void *data)
537 {
538 DeviceClass *dc = DEVICE_CLASS(oc);
539
540 dc->realize = ufs_lu_realize;
541 dc->unrealize = ufs_lu_unrealize;
542 dc->bus_type = TYPE_UFS_BUS;
543 device_class_set_props(dc, ufs_lu_props);
544 dc->desc = "Virtual UFS logical unit";
545 }
546
547 static const TypeInfo ufs_lu_info = {
548 .name = TYPE_UFS_LU,
549 .parent = TYPE_DEVICE,
550 .class_init = ufs_lu_class_init,
551 .instance_size = sizeof(UfsLu),
552 };
553
554 static void ufs_lu_register_types(void)
555 {
556 type_register_static(&ufs_lu_info);
557 }
558
559 type_init(ufs_lu_register_types)