esp: always check current_req is not NULL before use in DMA callbacks
[qemu.git] / hw / scsi / esp.c
1 /*
2 * QEMU ESP/NCR53C9x emulation
3 *
4 * Copyright (c) 2005-2006 Fabrice Bellard
5 * Copyright (c) 2012 Herve Poussineau
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25
26 #include "qemu/osdep.h"
27 #include "hw/sysbus.h"
28 #include "migration/vmstate.h"
29 #include "hw/irq.h"
30 #include "hw/scsi/esp.h"
31 #include "trace.h"
32 #include "qemu/log.h"
33 #include "qemu/module.h"
34
35 /*
36 * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
37 * also produced as NCR89C100. See
38 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
39 * and
40 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
41 *
42 * On Macintosh Quadra it is a NCR53C96.
43 */
44
45 static void esp_raise_irq(ESPState *s)
46 {
47 if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
48 s->rregs[ESP_RSTAT] |= STAT_INT;
49 qemu_irq_raise(s->irq);
50 trace_esp_raise_irq();
51 }
52 }
53
54 static void esp_lower_irq(ESPState *s)
55 {
56 if (s->rregs[ESP_RSTAT] & STAT_INT) {
57 s->rregs[ESP_RSTAT] &= ~STAT_INT;
58 qemu_irq_lower(s->irq);
59 trace_esp_lower_irq();
60 }
61 }
62
63 static void esp_raise_drq(ESPState *s)
64 {
65 qemu_irq_raise(s->irq_data);
66 trace_esp_raise_drq();
67 }
68
69 static void esp_lower_drq(ESPState *s)
70 {
71 qemu_irq_lower(s->irq_data);
72 trace_esp_lower_drq();
73 }
74
75 void esp_dma_enable(ESPState *s, int irq, int level)
76 {
77 if (level) {
78 s->dma_enabled = 1;
79 trace_esp_dma_enable();
80 if (s->dma_cb) {
81 s->dma_cb(s);
82 s->dma_cb = NULL;
83 }
84 } else {
85 trace_esp_dma_disable();
86 s->dma_enabled = 0;
87 }
88 }
89
90 void esp_request_cancelled(SCSIRequest *req)
91 {
92 ESPState *s = req->hba_private;
93
94 if (req == s->current_req) {
95 scsi_req_unref(s->current_req);
96 s->current_req = NULL;
97 s->current_dev = NULL;
98 }
99 }
100
101 static void esp_fifo_push(ESPState *s, uint8_t val)
102 {
103 if (fifo8_num_used(&s->fifo) == ESP_FIFO_SZ) {
104 trace_esp_error_fifo_overrun();
105 return;
106 }
107
108 fifo8_push(&s->fifo, val);
109 }
110
111 static uint8_t esp_fifo_pop(ESPState *s)
112 {
113 if (fifo8_is_empty(&s->fifo)) {
114 return 0;
115 }
116
117 return fifo8_pop(&s->fifo);
118 }
119
120 static void esp_cmdfifo_push(ESPState *s, uint8_t val)
121 {
122 if (fifo8_num_used(&s->cmdfifo) == ESP_CMDFIFO_SZ) {
123 trace_esp_error_fifo_overrun();
124 return;
125 }
126
127 fifo8_push(&s->cmdfifo, val);
128 }
129
130 static uint8_t esp_cmdfifo_pop(ESPState *s)
131 {
132 if (fifo8_is_empty(&s->cmdfifo)) {
133 return 0;
134 }
135
136 return fifo8_pop(&s->cmdfifo);
137 }
138
139 static uint32_t esp_get_tc(ESPState *s)
140 {
141 uint32_t dmalen;
142
143 dmalen = s->rregs[ESP_TCLO];
144 dmalen |= s->rregs[ESP_TCMID] << 8;
145 dmalen |= s->rregs[ESP_TCHI] << 16;
146
147 return dmalen;
148 }
149
150 static void esp_set_tc(ESPState *s, uint32_t dmalen)
151 {
152 s->rregs[ESP_TCLO] = dmalen;
153 s->rregs[ESP_TCMID] = dmalen >> 8;
154 s->rregs[ESP_TCHI] = dmalen >> 16;
155 }
156
157 static uint32_t esp_get_stc(ESPState *s)
158 {
159 uint32_t dmalen;
160
161 dmalen = s->wregs[ESP_TCLO];
162 dmalen |= s->wregs[ESP_TCMID] << 8;
163 dmalen |= s->wregs[ESP_TCHI] << 16;
164
165 return dmalen;
166 }
167
168 static uint8_t esp_pdma_read(ESPState *s)
169 {
170 uint8_t val;
171
172 if (s->do_cmd) {
173 val = esp_cmdfifo_pop(s);
174 } else {
175 val = esp_fifo_pop(s);
176 }
177
178 return val;
179 }
180
181 static void esp_pdma_write(ESPState *s, uint8_t val)
182 {
183 uint32_t dmalen = esp_get_tc(s);
184
185 if (dmalen == 0) {
186 return;
187 }
188
189 if (s->do_cmd) {
190 esp_cmdfifo_push(s, val);
191 } else {
192 esp_fifo_push(s, val);
193 }
194
195 dmalen--;
196 esp_set_tc(s, dmalen);
197 }
198
199 static int esp_select(ESPState *s)
200 {
201 int target;
202
203 target = s->wregs[ESP_WBUSID] & BUSID_DID;
204
205 s->ti_size = 0;
206 fifo8_reset(&s->fifo);
207
208 if (s->current_req) {
209 /* Started a new command before the old one finished. Cancel it. */
210 scsi_req_cancel(s->current_req);
211 s->async_len = 0;
212 }
213
214 s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
215 if (!s->current_dev) {
216 /* No such drive */
217 s->rregs[ESP_RSTAT] = 0;
218 s->rregs[ESP_RINTR] |= INTR_DC;
219 s->rregs[ESP_RSEQ] = SEQ_0;
220 esp_raise_irq(s);
221 return -1;
222 }
223
224 /*
225 * Note that we deliberately don't raise the IRQ here: this will be done
226 * either in do_busid_cmd() for DATA OUT transfers or by the deferred
227 * IRQ mechanism in esp_transfer_data() for DATA IN transfers
228 */
229 s->rregs[ESP_RINTR] |= INTR_FC;
230 s->rregs[ESP_RSEQ] = SEQ_CD;
231 return 0;
232 }
233
234 static uint32_t get_cmd(ESPState *s, uint32_t maxlen)
235 {
236 uint8_t buf[ESP_CMDFIFO_SZ];
237 uint32_t dmalen, n;
238 int target;
239
240 target = s->wregs[ESP_WBUSID] & BUSID_DID;
241 if (s->dma) {
242 dmalen = MIN(esp_get_tc(s), maxlen);
243 if (dmalen == 0) {
244 return 0;
245 }
246 if (s->dma_memory_read) {
247 s->dma_memory_read(s->dma_opaque, buf, dmalen);
248 fifo8_push_all(&s->cmdfifo, buf, dmalen);
249 } else {
250 if (esp_select(s) < 0) {
251 fifo8_reset(&s->cmdfifo);
252 return -1;
253 }
254 esp_raise_drq(s);
255 fifo8_reset(&s->cmdfifo);
256 return 0;
257 }
258 } else {
259 dmalen = MIN(fifo8_num_used(&s->fifo), maxlen);
260 if (dmalen == 0) {
261 return 0;
262 }
263 memcpy(buf, fifo8_pop_buf(&s->fifo, dmalen, &n), dmalen);
264 if (dmalen >= 3) {
265 buf[0] = buf[2] >> 5;
266 }
267 fifo8_push_all(&s->cmdfifo, buf, dmalen);
268 }
269 trace_esp_get_cmd(dmalen, target);
270
271 if (esp_select(s) < 0) {
272 fifo8_reset(&s->cmdfifo);
273 return -1;
274 }
275 return dmalen;
276 }
277
278 static void do_busid_cmd(ESPState *s, uint8_t busid)
279 {
280 uint32_t n, cmdlen;
281 int32_t datalen;
282 int lun;
283 SCSIDevice *current_lun;
284 uint8_t *buf;
285
286 trace_esp_do_busid_cmd(busid);
287 lun = busid & 7;
288 cmdlen = fifo8_num_used(&s->cmdfifo);
289 buf = (uint8_t *)fifo8_pop_buf(&s->cmdfifo, cmdlen, &n);
290
291 current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, lun);
292 s->current_req = scsi_req_new(current_lun, 0, lun, buf, s);
293 datalen = scsi_req_enqueue(s->current_req);
294 s->ti_size = datalen;
295 fifo8_reset(&s->cmdfifo);
296 if (datalen != 0) {
297 s->rregs[ESP_RSTAT] = STAT_TC;
298 s->rregs[ESP_RSEQ] = SEQ_CD;
299 s->ti_cmd = 0;
300 esp_set_tc(s, 0);
301 if (datalen > 0) {
302 /*
303 * Switch to DATA IN phase but wait until initial data xfer is
304 * complete before raising the command completion interrupt
305 */
306 s->data_in_ready = false;
307 s->rregs[ESP_RSTAT] |= STAT_DI;
308 } else {
309 s->rregs[ESP_RSTAT] |= STAT_DO;
310 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
311 esp_raise_irq(s);
312 esp_lower_drq(s);
313 }
314 scsi_req_continue(s->current_req);
315 return;
316 }
317 }
318
319 static void do_cmd(ESPState *s)
320 {
321 uint8_t busid = fifo8_pop(&s->cmdfifo);
322 uint32_t n;
323
324 s->cmdfifo_cdb_offset--;
325
326 /* Ignore extended messages for now */
327 if (s->cmdfifo_cdb_offset) {
328 fifo8_pop_buf(&s->cmdfifo, s->cmdfifo_cdb_offset, &n);
329 s->cmdfifo_cdb_offset = 0;
330 }
331
332 do_busid_cmd(s, busid);
333 }
334
335 static void satn_pdma_cb(ESPState *s)
336 {
337 s->do_cmd = 0;
338 if (!fifo8_is_empty(&s->cmdfifo)) {
339 s->cmdfifo_cdb_offset = 1;
340 do_cmd(s);
341 }
342 }
343
344 static void handle_satn(ESPState *s)
345 {
346 int32_t cmdlen;
347
348 if (s->dma && !s->dma_enabled) {
349 s->dma_cb = handle_satn;
350 return;
351 }
352 s->pdma_cb = satn_pdma_cb;
353 cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
354 if (cmdlen > 0) {
355 s->cmdfifo_cdb_offset = 1;
356 do_cmd(s);
357 } else if (cmdlen == 0) {
358 s->do_cmd = 1;
359 /* Target present, but no cmd yet - switch to command phase */
360 s->rregs[ESP_RSEQ] = SEQ_CD;
361 s->rregs[ESP_RSTAT] = STAT_CD;
362 }
363 }
364
365 static void s_without_satn_pdma_cb(ESPState *s)
366 {
367 uint32_t len;
368
369 s->do_cmd = 0;
370 len = fifo8_num_used(&s->cmdfifo);
371 if (len) {
372 s->cmdfifo_cdb_offset = 0;
373 do_busid_cmd(s, 0);
374 }
375 }
376
377 static void handle_s_without_atn(ESPState *s)
378 {
379 int32_t cmdlen;
380
381 if (s->dma && !s->dma_enabled) {
382 s->dma_cb = handle_s_without_atn;
383 return;
384 }
385 s->pdma_cb = s_without_satn_pdma_cb;
386 cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
387 if (cmdlen > 0) {
388 s->cmdfifo_cdb_offset = 0;
389 do_busid_cmd(s, 0);
390 } else if (cmdlen == 0) {
391 s->do_cmd = 1;
392 /* Target present, but no cmd yet - switch to command phase */
393 s->rregs[ESP_RSEQ] = SEQ_CD;
394 s->rregs[ESP_RSTAT] = STAT_CD;
395 }
396 }
397
398 static void satn_stop_pdma_cb(ESPState *s)
399 {
400 s->do_cmd = 0;
401 if (!fifo8_is_empty(&s->cmdfifo)) {
402 trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
403 s->do_cmd = 1;
404 s->cmdfifo_cdb_offset = 1;
405 s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
406 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
407 s->rregs[ESP_RSEQ] = SEQ_CD;
408 esp_raise_irq(s);
409 }
410 }
411
412 static void handle_satn_stop(ESPState *s)
413 {
414 int32_t cmdlen;
415
416 if (s->dma && !s->dma_enabled) {
417 s->dma_cb = handle_satn_stop;
418 return;
419 }
420 s->pdma_cb = satn_stop_pdma_cb;
421 cmdlen = get_cmd(s, 1);
422 if (cmdlen > 0) {
423 trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
424 s->do_cmd = 1;
425 s->cmdfifo_cdb_offset = 1;
426 s->rregs[ESP_RSTAT] = STAT_MO;
427 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
428 s->rregs[ESP_RSEQ] = SEQ_MO;
429 esp_raise_irq(s);
430 } else if (cmdlen == 0) {
431 s->do_cmd = 1;
432 /* Target present, switch to message out phase */
433 s->rregs[ESP_RSEQ] = SEQ_MO;
434 s->rregs[ESP_RSTAT] = STAT_MO;
435 }
436 }
437
438 static void write_response_pdma_cb(ESPState *s)
439 {
440 s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
441 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
442 s->rregs[ESP_RSEQ] = SEQ_CD;
443 esp_raise_irq(s);
444 }
445
446 static void write_response(ESPState *s)
447 {
448 uint32_t n;
449
450 trace_esp_write_response(s->status);
451
452 fifo8_reset(&s->fifo);
453 esp_fifo_push(s, s->status);
454 esp_fifo_push(s, 0);
455
456 if (s->dma) {
457 if (s->dma_memory_write) {
458 s->dma_memory_write(s->dma_opaque,
459 (uint8_t *)fifo8_pop_buf(&s->fifo, 2, &n), 2);
460 s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
461 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
462 s->rregs[ESP_RSEQ] = SEQ_CD;
463 } else {
464 s->pdma_cb = write_response_pdma_cb;
465 esp_raise_drq(s);
466 return;
467 }
468 } else {
469 s->ti_size = 2;
470 s->rregs[ESP_RFLAGS] = 2;
471 }
472 esp_raise_irq(s);
473 }
474
475 static void esp_dma_done(ESPState *s)
476 {
477 s->rregs[ESP_RSTAT] |= STAT_TC;
478 s->rregs[ESP_RINTR] |= INTR_BS;
479 s->rregs[ESP_RSEQ] = 0;
480 s->rregs[ESP_RFLAGS] = 0;
481 esp_set_tc(s, 0);
482 esp_raise_irq(s);
483 }
484
485 static void do_dma_pdma_cb(ESPState *s)
486 {
487 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
488 int len;
489 uint32_t n;
490
491 if (s->do_cmd) {
492 s->ti_size = 0;
493 s->do_cmd = 0;
494 do_cmd(s);
495 esp_lower_drq(s);
496 return;
497 }
498
499 if (!s->current_req) {
500 return;
501 }
502
503 if (to_device) {
504 /* Copy FIFO data to device */
505 len = MIN(s->async_len, ESP_FIFO_SZ);
506 len = MIN(len, fifo8_num_used(&s->fifo));
507 memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
508 s->async_buf += n;
509 s->async_len -= n;
510 s->ti_size += n;
511
512 if (n < len) {
513 /* Unaligned accesses can cause FIFO wraparound */
514 len = len - n;
515 memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
516 s->async_buf += n;
517 s->async_len -= n;
518 s->ti_size += n;
519 }
520
521 if (s->async_len == 0) {
522 scsi_req_continue(s->current_req);
523 return;
524 }
525
526 if (esp_get_tc(s) == 0) {
527 esp_lower_drq(s);
528 esp_dma_done(s);
529 }
530
531 return;
532 } else {
533 if (s->async_len == 0) {
534 /* Defer until the scsi layer has completed */
535 scsi_req_continue(s->current_req);
536 s->data_in_ready = false;
537 return;
538 }
539
540 if (esp_get_tc(s) != 0) {
541 /* Copy device data to FIFO */
542 len = MIN(s->async_len, esp_get_tc(s));
543 len = MIN(len, fifo8_num_free(&s->fifo));
544 fifo8_push_all(&s->fifo, s->async_buf, len);
545 s->async_buf += len;
546 s->async_len -= len;
547 s->ti_size -= len;
548 esp_set_tc(s, esp_get_tc(s) - len);
549
550 if (esp_get_tc(s) == 0) {
551 /* Indicate transfer to FIFO is complete */
552 s->rregs[ESP_RSTAT] |= STAT_TC;
553 }
554 return;
555 }
556
557 /* Partially filled a scsi buffer. Complete immediately. */
558 esp_lower_drq(s);
559 esp_dma_done(s);
560 }
561 }
562
563 static void esp_do_dma(ESPState *s)
564 {
565 uint32_t len, cmdlen;
566 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
567 uint8_t buf[ESP_CMDFIFO_SZ];
568
569 len = esp_get_tc(s);
570 if (s->do_cmd) {
571 /*
572 * handle_ti_cmd() case: esp_do_dma() is called only from
573 * handle_ti_cmd() with do_cmd != NULL (see the assert())
574 */
575 cmdlen = fifo8_num_used(&s->cmdfifo);
576 trace_esp_do_dma(cmdlen, len);
577 if (s->dma_memory_read) {
578 s->dma_memory_read(s->dma_opaque, buf, len);
579 fifo8_push_all(&s->cmdfifo, buf, len);
580 } else {
581 s->pdma_cb = do_dma_pdma_cb;
582 esp_raise_drq(s);
583 return;
584 }
585 trace_esp_handle_ti_cmd(cmdlen);
586 s->ti_size = 0;
587 if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
588 /* No command received */
589 if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
590 return;
591 }
592
593 /* Command has been received */
594 s->do_cmd = 0;
595 do_cmd(s);
596 } else {
597 /*
598 * Extra message out bytes received: update cmdfifo_cdb_offset
599 * and then switch to commmand phase
600 */
601 s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
602 s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
603 s->rregs[ESP_RSEQ] = SEQ_CD;
604 s->rregs[ESP_RINTR] |= INTR_BS;
605 esp_raise_irq(s);
606 }
607 return;
608 }
609 if (!s->current_req) {
610 return;
611 }
612 if (s->async_len == 0) {
613 /* Defer until data is available. */
614 return;
615 }
616 if (len > s->async_len) {
617 len = s->async_len;
618 }
619 if (to_device) {
620 if (s->dma_memory_read) {
621 s->dma_memory_read(s->dma_opaque, s->async_buf, len);
622 } else {
623 s->pdma_cb = do_dma_pdma_cb;
624 esp_raise_drq(s);
625 return;
626 }
627 } else {
628 if (s->dma_memory_write) {
629 s->dma_memory_write(s->dma_opaque, s->async_buf, len);
630 } else {
631 /* Adjust TC for any leftover data in the FIFO */
632 if (!fifo8_is_empty(&s->fifo)) {
633 esp_set_tc(s, esp_get_tc(s) - fifo8_num_used(&s->fifo));
634 }
635
636 /* Copy device data to FIFO */
637 len = MIN(len, fifo8_num_free(&s->fifo));
638 fifo8_push_all(&s->fifo, s->async_buf, len);
639 s->async_buf += len;
640 s->async_len -= len;
641 s->ti_size -= len;
642
643 /*
644 * MacOS toolbox uses a TI length of 16 bytes for all commands, so
645 * commands shorter than this must be padded accordingly
646 */
647 if (len < esp_get_tc(s) && esp_get_tc(s) <= ESP_FIFO_SZ) {
648 while (fifo8_num_used(&s->fifo) < ESP_FIFO_SZ) {
649 esp_fifo_push(s, 0);
650 len++;
651 }
652 }
653
654 esp_set_tc(s, esp_get_tc(s) - len);
655 s->pdma_cb = do_dma_pdma_cb;
656 esp_raise_drq(s);
657
658 /* Indicate transfer to FIFO is complete */
659 s->rregs[ESP_RSTAT] |= STAT_TC;
660 return;
661 }
662 }
663 esp_set_tc(s, esp_get_tc(s) - len);
664 s->async_buf += len;
665 s->async_len -= len;
666 if (to_device) {
667 s->ti_size += len;
668 } else {
669 s->ti_size -= len;
670 }
671 if (s->async_len == 0) {
672 scsi_req_continue(s->current_req);
673 /*
674 * If there is still data to be read from the device then
675 * complete the DMA operation immediately. Otherwise defer
676 * until the scsi layer has completed.
677 */
678 if (to_device || esp_get_tc(s) != 0 || s->ti_size == 0) {
679 return;
680 }
681 }
682
683 /* Partially filled a scsi buffer. Complete immediately. */
684 esp_dma_done(s);
685 esp_lower_drq(s);
686 }
687
688 static void esp_do_nodma(ESPState *s)
689 {
690 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
691 uint32_t cmdlen, n;
692 int len;
693
694 if (s->do_cmd) {
695 cmdlen = fifo8_num_used(&s->cmdfifo);
696 trace_esp_handle_ti_cmd(cmdlen);
697 s->ti_size = 0;
698 if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
699 /* No command received */
700 if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
701 return;
702 }
703
704 /* Command has been received */
705 s->do_cmd = 0;
706 do_cmd(s);
707 } else {
708 /*
709 * Extra message out bytes received: update cmdfifo_cdb_offset
710 * and then switch to commmand phase
711 */
712 s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
713 s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
714 s->rregs[ESP_RSEQ] = SEQ_CD;
715 s->rregs[ESP_RINTR] |= INTR_BS;
716 esp_raise_irq(s);
717 }
718 return;
719 }
720
721 if (!s->current_req) {
722 return;
723 }
724
725 if (s->async_len == 0) {
726 /* Defer until data is available. */
727 return;
728 }
729
730 if (to_device) {
731 len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
732 memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
733 s->async_buf += len;
734 s->async_len -= len;
735 s->ti_size += len;
736 } else {
737 len = MIN(s->ti_size, s->async_len);
738 len = MIN(len, fifo8_num_free(&s->fifo));
739 fifo8_push_all(&s->fifo, s->async_buf, len);
740 s->async_buf += len;
741 s->async_len -= len;
742 s->ti_size -= len;
743 }
744
745 if (s->async_len == 0) {
746 scsi_req_continue(s->current_req);
747
748 if (to_device || s->ti_size == 0) {
749 return;
750 }
751 }
752
753 s->rregs[ESP_RINTR] |= INTR_BS;
754 esp_raise_irq(s);
755 }
756
757 void esp_command_complete(SCSIRequest *req, size_t resid)
758 {
759 ESPState *s = req->hba_private;
760
761 trace_esp_command_complete();
762 if (s->ti_size != 0) {
763 trace_esp_command_complete_unexpected();
764 }
765 s->ti_size = 0;
766 s->async_len = 0;
767 if (req->status) {
768 trace_esp_command_complete_fail();
769 }
770 s->status = req->status;
771 s->rregs[ESP_RSTAT] = STAT_ST;
772 esp_dma_done(s);
773 esp_lower_drq(s);
774 if (s->current_req) {
775 scsi_req_unref(s->current_req);
776 s->current_req = NULL;
777 s->current_dev = NULL;
778 }
779 }
780
781 void esp_transfer_data(SCSIRequest *req, uint32_t len)
782 {
783 ESPState *s = req->hba_private;
784 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
785 uint32_t dmalen = esp_get_tc(s);
786
787 assert(!s->do_cmd);
788 trace_esp_transfer_data(dmalen, s->ti_size);
789 s->async_len = len;
790 s->async_buf = scsi_req_get_buf(req);
791
792 if (!to_device && !s->data_in_ready) {
793 /*
794 * Initial incoming data xfer is complete so raise command
795 * completion interrupt
796 */
797 s->data_in_ready = true;
798 s->rregs[ESP_RSTAT] |= STAT_TC;
799 s->rregs[ESP_RINTR] |= INTR_BS;
800 esp_raise_irq(s);
801
802 /*
803 * If data is ready to transfer and the TI command has already
804 * been executed, start DMA immediately. Otherwise DMA will start
805 * when host sends the TI command
806 */
807 if (s->ti_size && (s->rregs[ESP_CMD] == (CMD_TI | CMD_DMA))) {
808 esp_do_dma(s);
809 }
810 return;
811 }
812
813 if (s->ti_cmd == 0) {
814 /*
815 * Always perform the initial transfer upon reception of the next TI
816 * command to ensure the DMA/non-DMA status of the command is correct.
817 * It is not possible to use s->dma directly in the section below as
818 * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the
819 * async data transfer is delayed then s->dma is set incorrectly.
820 */
821 return;
822 }
823
824 if (s->ti_cmd & CMD_DMA) {
825 if (dmalen) {
826 esp_do_dma(s);
827 } else if (s->ti_size <= 0) {
828 /*
829 * If this was the last part of a DMA transfer then the
830 * completion interrupt is deferred to here.
831 */
832 esp_dma_done(s);
833 esp_lower_drq(s);
834 }
835 } else {
836 esp_do_nodma(s);
837 }
838 }
839
840 static void handle_ti(ESPState *s)
841 {
842 uint32_t dmalen;
843
844 if (s->dma && !s->dma_enabled) {
845 s->dma_cb = handle_ti;
846 return;
847 }
848
849 s->ti_cmd = s->rregs[ESP_CMD];
850 if (s->dma) {
851 dmalen = esp_get_tc(s);
852 trace_esp_handle_ti(dmalen);
853 s->rregs[ESP_RSTAT] &= ~STAT_TC;
854 esp_do_dma(s);
855 } else {
856 trace_esp_handle_ti(s->ti_size);
857 esp_do_nodma(s);
858 }
859 }
860
861 void esp_hard_reset(ESPState *s)
862 {
863 memset(s->rregs, 0, ESP_REGS);
864 memset(s->wregs, 0, ESP_REGS);
865 s->tchi_written = 0;
866 s->ti_size = 0;
867 fifo8_reset(&s->fifo);
868 fifo8_reset(&s->cmdfifo);
869 s->dma = 0;
870 s->do_cmd = 0;
871 s->dma_cb = NULL;
872
873 s->rregs[ESP_CFG1] = 7;
874 }
875
876 static void esp_soft_reset(ESPState *s)
877 {
878 qemu_irq_lower(s->irq);
879 qemu_irq_lower(s->irq_data);
880 esp_hard_reset(s);
881 }
882
883 static void parent_esp_reset(ESPState *s, int irq, int level)
884 {
885 if (level) {
886 esp_soft_reset(s);
887 }
888 }
889
890 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
891 {
892 uint32_t val;
893
894 switch (saddr) {
895 case ESP_FIFO:
896 if (s->dma_memory_read && s->dma_memory_write &&
897 (s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
898 /* Data out. */
899 qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
900 s->rregs[ESP_FIFO] = 0;
901 } else {
902 s->rregs[ESP_FIFO] = esp_fifo_pop(s);
903 }
904 val = s->rregs[ESP_FIFO];
905 break;
906 case ESP_RINTR:
907 /*
908 * Clear sequence step, interrupt register and all status bits
909 * except TC
910 */
911 val = s->rregs[ESP_RINTR];
912 s->rregs[ESP_RINTR] = 0;
913 s->rregs[ESP_RSTAT] &= ~STAT_TC;
914 s->rregs[ESP_RSEQ] = SEQ_0;
915 esp_lower_irq(s);
916 break;
917 case ESP_TCHI:
918 /* Return the unique id if the value has never been written */
919 if (!s->tchi_written) {
920 val = s->chip_id;
921 } else {
922 val = s->rregs[saddr];
923 }
924 break;
925 case ESP_RFLAGS:
926 /* Bottom 5 bits indicate number of bytes in FIFO */
927 val = fifo8_num_used(&s->fifo);
928 break;
929 default:
930 val = s->rregs[saddr];
931 break;
932 }
933
934 trace_esp_mem_readb(saddr, val);
935 return val;
936 }
937
938 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
939 {
940 trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
941 switch (saddr) {
942 case ESP_TCHI:
943 s->tchi_written = true;
944 /* fall through */
945 case ESP_TCLO:
946 case ESP_TCMID:
947 s->rregs[ESP_RSTAT] &= ~STAT_TC;
948 break;
949 case ESP_FIFO:
950 if (s->do_cmd) {
951 esp_cmdfifo_push(s, val);
952 } else {
953 esp_fifo_push(s, val);
954 }
955
956 /* Non-DMA transfers raise an interrupt after every byte */
957 if (s->rregs[ESP_CMD] == CMD_TI) {
958 s->rregs[ESP_RINTR] |= INTR_FC | INTR_BS;
959 esp_raise_irq(s);
960 }
961 break;
962 case ESP_CMD:
963 s->rregs[saddr] = val;
964 if (val & CMD_DMA) {
965 s->dma = 1;
966 /* Reload DMA counter. */
967 if (esp_get_stc(s) == 0) {
968 esp_set_tc(s, 0x10000);
969 } else {
970 esp_set_tc(s, esp_get_stc(s));
971 }
972 } else {
973 s->dma = 0;
974 }
975 switch (val & CMD_CMD) {
976 case CMD_NOP:
977 trace_esp_mem_writeb_cmd_nop(val);
978 break;
979 case CMD_FLUSH:
980 trace_esp_mem_writeb_cmd_flush(val);
981 fifo8_reset(&s->fifo);
982 break;
983 case CMD_RESET:
984 trace_esp_mem_writeb_cmd_reset(val);
985 esp_soft_reset(s);
986 break;
987 case CMD_BUSRESET:
988 trace_esp_mem_writeb_cmd_bus_reset(val);
989 if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
990 s->rregs[ESP_RINTR] |= INTR_RST;
991 esp_raise_irq(s);
992 }
993 break;
994 case CMD_TI:
995 trace_esp_mem_writeb_cmd_ti(val);
996 handle_ti(s);
997 break;
998 case CMD_ICCS:
999 trace_esp_mem_writeb_cmd_iccs(val);
1000 write_response(s);
1001 s->rregs[ESP_RINTR] |= INTR_FC;
1002 s->rregs[ESP_RSTAT] |= STAT_MI;
1003 break;
1004 case CMD_MSGACC:
1005 trace_esp_mem_writeb_cmd_msgacc(val);
1006 s->rregs[ESP_RINTR] |= INTR_DC;
1007 s->rregs[ESP_RSEQ] = 0;
1008 s->rregs[ESP_RFLAGS] = 0;
1009 esp_raise_irq(s);
1010 break;
1011 case CMD_PAD:
1012 trace_esp_mem_writeb_cmd_pad(val);
1013 s->rregs[ESP_RSTAT] = STAT_TC;
1014 s->rregs[ESP_RINTR] |= INTR_FC;
1015 s->rregs[ESP_RSEQ] = 0;
1016 break;
1017 case CMD_SATN:
1018 trace_esp_mem_writeb_cmd_satn(val);
1019 break;
1020 case CMD_RSTATN:
1021 trace_esp_mem_writeb_cmd_rstatn(val);
1022 break;
1023 case CMD_SEL:
1024 trace_esp_mem_writeb_cmd_sel(val);
1025 handle_s_without_atn(s);
1026 break;
1027 case CMD_SELATN:
1028 trace_esp_mem_writeb_cmd_selatn(val);
1029 handle_satn(s);
1030 break;
1031 case CMD_SELATNS:
1032 trace_esp_mem_writeb_cmd_selatns(val);
1033 handle_satn_stop(s);
1034 break;
1035 case CMD_ENSEL:
1036 trace_esp_mem_writeb_cmd_ensel(val);
1037 s->rregs[ESP_RINTR] = 0;
1038 break;
1039 case CMD_DISSEL:
1040 trace_esp_mem_writeb_cmd_dissel(val);
1041 s->rregs[ESP_RINTR] = 0;
1042 esp_raise_irq(s);
1043 break;
1044 default:
1045 trace_esp_error_unhandled_command(val);
1046 break;
1047 }
1048 break;
1049 case ESP_WBUSID ... ESP_WSYNO:
1050 break;
1051 case ESP_CFG1:
1052 case ESP_CFG2: case ESP_CFG3:
1053 case ESP_RES3: case ESP_RES4:
1054 s->rregs[saddr] = val;
1055 break;
1056 case ESP_WCCF ... ESP_WTEST:
1057 break;
1058 default:
1059 trace_esp_error_invalid_write(val, saddr);
1060 return;
1061 }
1062 s->wregs[saddr] = val;
1063 }
1064
1065 static bool esp_mem_accepts(void *opaque, hwaddr addr,
1066 unsigned size, bool is_write,
1067 MemTxAttrs attrs)
1068 {
1069 return (size == 1) || (is_write && size == 4);
1070 }
1071
1072 static bool esp_is_before_version_5(void *opaque, int version_id)
1073 {
1074 ESPState *s = ESP(opaque);
1075
1076 version_id = MIN(version_id, s->mig_version_id);
1077 return version_id < 5;
1078 }
1079
1080 static bool esp_is_version_5(void *opaque, int version_id)
1081 {
1082 ESPState *s = ESP(opaque);
1083
1084 version_id = MIN(version_id, s->mig_version_id);
1085 return version_id == 5;
1086 }
1087
1088 int esp_pre_save(void *opaque)
1089 {
1090 ESPState *s = ESP(object_resolve_path_component(
1091 OBJECT(opaque), "esp"));
1092
1093 s->mig_version_id = vmstate_esp.version_id;
1094 return 0;
1095 }
1096
1097 static int esp_post_load(void *opaque, int version_id)
1098 {
1099 ESPState *s = ESP(opaque);
1100 int len, i;
1101
1102 version_id = MIN(version_id, s->mig_version_id);
1103
1104 if (version_id < 5) {
1105 esp_set_tc(s, s->mig_dma_left);
1106
1107 /* Migrate ti_buf to fifo */
1108 len = s->mig_ti_wptr - s->mig_ti_rptr;
1109 for (i = 0; i < len; i++) {
1110 fifo8_push(&s->fifo, s->mig_ti_buf[i]);
1111 }
1112
1113 /* Migrate cmdbuf to cmdfifo */
1114 for (i = 0; i < s->mig_cmdlen; i++) {
1115 fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
1116 }
1117 }
1118
1119 s->mig_version_id = vmstate_esp.version_id;
1120 return 0;
1121 }
1122
1123 const VMStateDescription vmstate_esp = {
1124 .name = "esp",
1125 .version_id = 5,
1126 .minimum_version_id = 3,
1127 .post_load = esp_post_load,
1128 .fields = (VMStateField[]) {
1129 VMSTATE_BUFFER(rregs, ESPState),
1130 VMSTATE_BUFFER(wregs, ESPState),
1131 VMSTATE_INT32(ti_size, ESPState),
1132 VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5),
1133 VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5),
1134 VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5),
1135 VMSTATE_UINT32(status, ESPState),
1136 VMSTATE_UINT32_TEST(mig_deferred_status, ESPState,
1137 esp_is_before_version_5),
1138 VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState,
1139 esp_is_before_version_5),
1140 VMSTATE_UINT32(dma, ESPState),
1141 VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0,
1142 esp_is_before_version_5, 0, 16),
1143 VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4,
1144 esp_is_before_version_5, 16,
1145 sizeof(typeof_field(ESPState, mig_cmdbuf))),
1146 VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5),
1147 VMSTATE_UINT32(do_cmd, ESPState),
1148 VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5),
1149 VMSTATE_BOOL_TEST(data_in_ready, ESPState, esp_is_version_5),
1150 VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5),
1151 VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5),
1152 VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5),
1153 VMSTATE_UINT8_TEST(ti_cmd, ESPState, esp_is_version_5),
1154 VMSTATE_END_OF_LIST()
1155 },
1156 };
1157
1158 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
1159 uint64_t val, unsigned int size)
1160 {
1161 SysBusESPState *sysbus = opaque;
1162 ESPState *s = ESP(&sysbus->esp);
1163 uint32_t saddr;
1164
1165 saddr = addr >> sysbus->it_shift;
1166 esp_reg_write(s, saddr, val);
1167 }
1168
1169 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
1170 unsigned int size)
1171 {
1172 SysBusESPState *sysbus = opaque;
1173 ESPState *s = ESP(&sysbus->esp);
1174 uint32_t saddr;
1175
1176 saddr = addr >> sysbus->it_shift;
1177 return esp_reg_read(s, saddr);
1178 }
1179
1180 static const MemoryRegionOps sysbus_esp_mem_ops = {
1181 .read = sysbus_esp_mem_read,
1182 .write = sysbus_esp_mem_write,
1183 .endianness = DEVICE_NATIVE_ENDIAN,
1184 .valid.accepts = esp_mem_accepts,
1185 };
1186
1187 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
1188 uint64_t val, unsigned int size)
1189 {
1190 SysBusESPState *sysbus = opaque;
1191 ESPState *s = ESP(&sysbus->esp);
1192 uint32_t dmalen;
1193
1194 trace_esp_pdma_write(size);
1195
1196 switch (size) {
1197 case 1:
1198 esp_pdma_write(s, val);
1199 break;
1200 case 2:
1201 esp_pdma_write(s, val >> 8);
1202 esp_pdma_write(s, val);
1203 break;
1204 }
1205 dmalen = esp_get_tc(s);
1206 if (dmalen == 0 || fifo8_num_free(&s->fifo) < 2) {
1207 s->pdma_cb(s);
1208 }
1209 }
1210
1211 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
1212 unsigned int size)
1213 {
1214 SysBusESPState *sysbus = opaque;
1215 ESPState *s = ESP(&sysbus->esp);
1216 uint64_t val = 0;
1217
1218 trace_esp_pdma_read(size);
1219
1220 switch (size) {
1221 case 1:
1222 val = esp_pdma_read(s);
1223 break;
1224 case 2:
1225 val = esp_pdma_read(s);
1226 val = (val << 8) | esp_pdma_read(s);
1227 break;
1228 }
1229 if (fifo8_num_used(&s->fifo) < 2) {
1230 s->pdma_cb(s);
1231 }
1232 return val;
1233 }
1234
1235 static const MemoryRegionOps sysbus_esp_pdma_ops = {
1236 .read = sysbus_esp_pdma_read,
1237 .write = sysbus_esp_pdma_write,
1238 .endianness = DEVICE_NATIVE_ENDIAN,
1239 .valid.min_access_size = 1,
1240 .valid.max_access_size = 4,
1241 .impl.min_access_size = 1,
1242 .impl.max_access_size = 2,
1243 };
1244
1245 static const struct SCSIBusInfo esp_scsi_info = {
1246 .tcq = false,
1247 .max_target = ESP_MAX_DEVS,
1248 .max_lun = 7,
1249
1250 .transfer_data = esp_transfer_data,
1251 .complete = esp_command_complete,
1252 .cancel = esp_request_cancelled
1253 };
1254
1255 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
1256 {
1257 SysBusESPState *sysbus = SYSBUS_ESP(opaque);
1258 ESPState *s = ESP(&sysbus->esp);
1259
1260 switch (irq) {
1261 case 0:
1262 parent_esp_reset(s, irq, level);
1263 break;
1264 case 1:
1265 esp_dma_enable(opaque, irq, level);
1266 break;
1267 }
1268 }
1269
1270 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
1271 {
1272 SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1273 SysBusESPState *sysbus = SYSBUS_ESP(dev);
1274 ESPState *s = ESP(&sysbus->esp);
1275
1276 if (!qdev_realize(DEVICE(s), NULL, errp)) {
1277 return;
1278 }
1279
1280 sysbus_init_irq(sbd, &s->irq);
1281 sysbus_init_irq(sbd, &s->irq_data);
1282 assert(sysbus->it_shift != -1);
1283
1284 s->chip_id = TCHI_FAS100A;
1285 memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
1286 sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
1287 sysbus_init_mmio(sbd, &sysbus->iomem);
1288 memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
1289 sysbus, "esp-pdma", 4);
1290 sysbus_init_mmio(sbd, &sysbus->pdma);
1291
1292 qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
1293
1294 scsi_bus_new(&s->bus, sizeof(s->bus), dev, &esp_scsi_info, NULL);
1295 }
1296
1297 static void sysbus_esp_hard_reset(DeviceState *dev)
1298 {
1299 SysBusESPState *sysbus = SYSBUS_ESP(dev);
1300 ESPState *s = ESP(&sysbus->esp);
1301
1302 esp_hard_reset(s);
1303 }
1304
1305 static void sysbus_esp_init(Object *obj)
1306 {
1307 SysBusESPState *sysbus = SYSBUS_ESP(obj);
1308
1309 object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
1310 }
1311
1312 static const VMStateDescription vmstate_sysbus_esp_scsi = {
1313 .name = "sysbusespscsi",
1314 .version_id = 2,
1315 .minimum_version_id = 1,
1316 .pre_save = esp_pre_save,
1317 .fields = (VMStateField[]) {
1318 VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
1319 VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
1320 VMSTATE_END_OF_LIST()
1321 }
1322 };
1323
1324 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
1325 {
1326 DeviceClass *dc = DEVICE_CLASS(klass);
1327
1328 dc->realize = sysbus_esp_realize;
1329 dc->reset = sysbus_esp_hard_reset;
1330 dc->vmsd = &vmstate_sysbus_esp_scsi;
1331 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1332 }
1333
1334 static const TypeInfo sysbus_esp_info = {
1335 .name = TYPE_SYSBUS_ESP,
1336 .parent = TYPE_SYS_BUS_DEVICE,
1337 .instance_init = sysbus_esp_init,
1338 .instance_size = sizeof(SysBusESPState),
1339 .class_init = sysbus_esp_class_init,
1340 };
1341
1342 static void esp_finalize(Object *obj)
1343 {
1344 ESPState *s = ESP(obj);
1345
1346 fifo8_destroy(&s->fifo);
1347 fifo8_destroy(&s->cmdfifo);
1348 }
1349
1350 static void esp_init(Object *obj)
1351 {
1352 ESPState *s = ESP(obj);
1353
1354 fifo8_create(&s->fifo, ESP_FIFO_SZ);
1355 fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ);
1356 }
1357
1358 static void esp_class_init(ObjectClass *klass, void *data)
1359 {
1360 DeviceClass *dc = DEVICE_CLASS(klass);
1361
1362 /* internal device for sysbusesp/pciespscsi, not user-creatable */
1363 dc->user_creatable = false;
1364 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1365 }
1366
1367 static const TypeInfo esp_info = {
1368 .name = TYPE_ESP,
1369 .parent = TYPE_DEVICE,
1370 .instance_init = esp_init,
1371 .instance_finalize = esp_finalize,
1372 .instance_size = sizeof(ESPState),
1373 .class_init = esp_class_init,
1374 };
1375
1376 static void esp_register_types(void)
1377 {
1378 type_register_static(&sysbus_esp_info);
1379 type_register_static(&esp_info);
1380 }
1381
1382 type_init(esp_register_types)