esp: don't underflow cmdfifo in do_cmd()
[qemu.git] / hw / scsi / esp.c
1 /*
2 * QEMU ESP/NCR53C9x emulation
3 *
4 * Copyright (c) 2005-2006 Fabrice Bellard
5 * Copyright (c) 2012 Herve Poussineau
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25
26 #include "qemu/osdep.h"
27 #include "hw/sysbus.h"
28 #include "migration/vmstate.h"
29 #include "hw/irq.h"
30 #include "hw/scsi/esp.h"
31 #include "trace.h"
32 #include "qemu/log.h"
33 #include "qemu/module.h"
34
35 /*
36 * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
37 * also produced as NCR89C100. See
38 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
39 * and
40 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
41 *
42 * On Macintosh Quadra it is a NCR53C96.
43 */
44
45 static void esp_raise_irq(ESPState *s)
46 {
47 if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
48 s->rregs[ESP_RSTAT] |= STAT_INT;
49 qemu_irq_raise(s->irq);
50 trace_esp_raise_irq();
51 }
52 }
53
54 static void esp_lower_irq(ESPState *s)
55 {
56 if (s->rregs[ESP_RSTAT] & STAT_INT) {
57 s->rregs[ESP_RSTAT] &= ~STAT_INT;
58 qemu_irq_lower(s->irq);
59 trace_esp_lower_irq();
60 }
61 }
62
63 static void esp_raise_drq(ESPState *s)
64 {
65 qemu_irq_raise(s->irq_data);
66 trace_esp_raise_drq();
67 }
68
69 static void esp_lower_drq(ESPState *s)
70 {
71 qemu_irq_lower(s->irq_data);
72 trace_esp_lower_drq();
73 }
74
75 void esp_dma_enable(ESPState *s, int irq, int level)
76 {
77 if (level) {
78 s->dma_enabled = 1;
79 trace_esp_dma_enable();
80 if (s->dma_cb) {
81 s->dma_cb(s);
82 s->dma_cb = NULL;
83 }
84 } else {
85 trace_esp_dma_disable();
86 s->dma_enabled = 0;
87 }
88 }
89
90 void esp_request_cancelled(SCSIRequest *req)
91 {
92 ESPState *s = req->hba_private;
93
94 if (req == s->current_req) {
95 scsi_req_unref(s->current_req);
96 s->current_req = NULL;
97 s->current_dev = NULL;
98 }
99 }
100
101 static void esp_fifo_push(Fifo8 *fifo, uint8_t val)
102 {
103 if (fifo8_num_used(fifo) == fifo->capacity) {
104 trace_esp_error_fifo_overrun();
105 return;
106 }
107
108 fifo8_push(fifo, val);
109 }
110
111 static uint8_t esp_fifo_pop(Fifo8 *fifo)
112 {
113 if (fifo8_is_empty(fifo)) {
114 return 0;
115 }
116
117 return fifo8_pop(fifo);
118 }
119
120 static uint32_t esp_fifo_pop_buf(Fifo8 *fifo, uint8_t *dest, int maxlen)
121 {
122 const uint8_t *buf;
123 uint32_t n;
124
125 if (maxlen == 0) {
126 return 0;
127 }
128
129 buf = fifo8_pop_buf(fifo, maxlen, &n);
130 if (dest) {
131 memcpy(dest, buf, n);
132 }
133
134 return n;
135 }
136
137 static uint32_t esp_get_tc(ESPState *s)
138 {
139 uint32_t dmalen;
140
141 dmalen = s->rregs[ESP_TCLO];
142 dmalen |= s->rregs[ESP_TCMID] << 8;
143 dmalen |= s->rregs[ESP_TCHI] << 16;
144
145 return dmalen;
146 }
147
148 static void esp_set_tc(ESPState *s, uint32_t dmalen)
149 {
150 s->rregs[ESP_TCLO] = dmalen;
151 s->rregs[ESP_TCMID] = dmalen >> 8;
152 s->rregs[ESP_TCHI] = dmalen >> 16;
153 }
154
155 static uint32_t esp_get_stc(ESPState *s)
156 {
157 uint32_t dmalen;
158
159 dmalen = s->wregs[ESP_TCLO];
160 dmalen |= s->wregs[ESP_TCMID] << 8;
161 dmalen |= s->wregs[ESP_TCHI] << 16;
162
163 return dmalen;
164 }
165
166 static uint8_t esp_pdma_read(ESPState *s)
167 {
168 uint8_t val;
169
170 if (s->do_cmd) {
171 val = esp_fifo_pop(&s->cmdfifo);
172 } else {
173 val = esp_fifo_pop(&s->fifo);
174 }
175
176 return val;
177 }
178
179 static void esp_pdma_write(ESPState *s, uint8_t val)
180 {
181 uint32_t dmalen = esp_get_tc(s);
182
183 if (dmalen == 0) {
184 return;
185 }
186
187 if (s->do_cmd) {
188 esp_fifo_push(&s->cmdfifo, val);
189 } else {
190 esp_fifo_push(&s->fifo, val);
191 }
192
193 dmalen--;
194 esp_set_tc(s, dmalen);
195 }
196
197 static int esp_select(ESPState *s)
198 {
199 int target;
200
201 target = s->wregs[ESP_WBUSID] & BUSID_DID;
202
203 s->ti_size = 0;
204 fifo8_reset(&s->fifo);
205
206 if (s->current_req) {
207 /* Started a new command before the old one finished. Cancel it. */
208 scsi_req_cancel(s->current_req);
209 s->async_len = 0;
210 }
211
212 s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
213 if (!s->current_dev) {
214 /* No such drive */
215 s->rregs[ESP_RSTAT] = 0;
216 s->rregs[ESP_RINTR] |= INTR_DC;
217 s->rregs[ESP_RSEQ] = SEQ_0;
218 esp_raise_irq(s);
219 return -1;
220 }
221
222 /*
223 * Note that we deliberately don't raise the IRQ here: this will be done
224 * either in do_busid_cmd() for DATA OUT transfers or by the deferred
225 * IRQ mechanism in esp_transfer_data() for DATA IN transfers
226 */
227 s->rregs[ESP_RINTR] |= INTR_FC;
228 s->rregs[ESP_RSEQ] = SEQ_CD;
229 return 0;
230 }
231
232 static uint32_t get_cmd(ESPState *s, uint32_t maxlen)
233 {
234 uint8_t buf[ESP_CMDFIFO_SZ];
235 uint32_t dmalen, n;
236 int target;
237
238 target = s->wregs[ESP_WBUSID] & BUSID_DID;
239 if (s->dma) {
240 dmalen = MIN(esp_get_tc(s), maxlen);
241 if (dmalen == 0) {
242 return 0;
243 }
244 if (s->dma_memory_read) {
245 s->dma_memory_read(s->dma_opaque, buf, dmalen);
246 fifo8_push_all(&s->cmdfifo, buf, dmalen);
247 } else {
248 if (esp_select(s) < 0) {
249 fifo8_reset(&s->cmdfifo);
250 return -1;
251 }
252 esp_raise_drq(s);
253 fifo8_reset(&s->cmdfifo);
254 return 0;
255 }
256 } else {
257 dmalen = MIN(fifo8_num_used(&s->fifo), maxlen);
258 if (dmalen == 0) {
259 return 0;
260 }
261 n = esp_fifo_pop_buf(&s->fifo, buf, dmalen);
262 if (n >= 3) {
263 buf[0] = buf[2] >> 5;
264 }
265 fifo8_push_all(&s->cmdfifo, buf, n);
266 }
267 trace_esp_get_cmd(dmalen, target);
268
269 if (esp_select(s) < 0) {
270 fifo8_reset(&s->cmdfifo);
271 return -1;
272 }
273 return dmalen;
274 }
275
276 static void do_busid_cmd(ESPState *s, uint8_t busid)
277 {
278 uint32_t cmdlen;
279 int32_t datalen;
280 int lun;
281 SCSIDevice *current_lun;
282 uint8_t buf[ESP_CMDFIFO_SZ];
283
284 trace_esp_do_busid_cmd(busid);
285 lun = busid & 7;
286 cmdlen = fifo8_num_used(&s->cmdfifo);
287 if (!cmdlen || !s->current_dev) {
288 return;
289 }
290 esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
291
292 current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, lun);
293 s->current_req = scsi_req_new(current_lun, 0, lun, buf, s);
294 datalen = scsi_req_enqueue(s->current_req);
295 s->ti_size = datalen;
296 fifo8_reset(&s->cmdfifo);
297 if (datalen != 0) {
298 s->rregs[ESP_RSTAT] = STAT_TC;
299 s->rregs[ESP_RSEQ] = SEQ_CD;
300 s->ti_cmd = 0;
301 esp_set_tc(s, 0);
302 if (datalen > 0) {
303 /*
304 * Switch to DATA IN phase but wait until initial data xfer is
305 * complete before raising the command completion interrupt
306 */
307 s->data_in_ready = false;
308 s->rregs[ESP_RSTAT] |= STAT_DI;
309 } else {
310 s->rregs[ESP_RSTAT] |= STAT_DO;
311 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
312 esp_raise_irq(s);
313 esp_lower_drq(s);
314 }
315 scsi_req_continue(s->current_req);
316 return;
317 }
318 }
319
320 static void do_cmd(ESPState *s)
321 {
322 uint8_t busid = esp_fifo_pop(&s->cmdfifo);
323 int len;
324
325 s->cmdfifo_cdb_offset--;
326
327 /* Ignore extended messages for now */
328 if (s->cmdfifo_cdb_offset) {
329 len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo));
330 esp_fifo_pop_buf(&s->cmdfifo, NULL, len);
331 s->cmdfifo_cdb_offset = 0;
332 }
333
334 do_busid_cmd(s, busid);
335 }
336
337 static void satn_pdma_cb(ESPState *s)
338 {
339 s->do_cmd = 0;
340 if (!fifo8_is_empty(&s->cmdfifo)) {
341 s->cmdfifo_cdb_offset = 1;
342 do_cmd(s);
343 }
344 }
345
346 static void handle_satn(ESPState *s)
347 {
348 int32_t cmdlen;
349
350 if (s->dma && !s->dma_enabled) {
351 s->dma_cb = handle_satn;
352 return;
353 }
354 s->pdma_cb = satn_pdma_cb;
355 cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
356 if (cmdlen > 0) {
357 s->cmdfifo_cdb_offset = 1;
358 do_cmd(s);
359 } else if (cmdlen == 0) {
360 s->do_cmd = 1;
361 /* Target present, but no cmd yet - switch to command phase */
362 s->rregs[ESP_RSEQ] = SEQ_CD;
363 s->rregs[ESP_RSTAT] = STAT_CD;
364 }
365 }
366
367 static void s_without_satn_pdma_cb(ESPState *s)
368 {
369 uint32_t len;
370
371 s->do_cmd = 0;
372 len = fifo8_num_used(&s->cmdfifo);
373 if (len) {
374 s->cmdfifo_cdb_offset = 0;
375 do_busid_cmd(s, 0);
376 }
377 }
378
379 static void handle_s_without_atn(ESPState *s)
380 {
381 int32_t cmdlen;
382
383 if (s->dma && !s->dma_enabled) {
384 s->dma_cb = handle_s_without_atn;
385 return;
386 }
387 s->pdma_cb = s_without_satn_pdma_cb;
388 cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
389 if (cmdlen > 0) {
390 s->cmdfifo_cdb_offset = 0;
391 do_busid_cmd(s, 0);
392 } else if (cmdlen == 0) {
393 s->do_cmd = 1;
394 /* Target present, but no cmd yet - switch to command phase */
395 s->rregs[ESP_RSEQ] = SEQ_CD;
396 s->rregs[ESP_RSTAT] = STAT_CD;
397 }
398 }
399
400 static void satn_stop_pdma_cb(ESPState *s)
401 {
402 s->do_cmd = 0;
403 if (!fifo8_is_empty(&s->cmdfifo)) {
404 trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
405 s->do_cmd = 1;
406 s->cmdfifo_cdb_offset = 1;
407 s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
408 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
409 s->rregs[ESP_RSEQ] = SEQ_CD;
410 esp_raise_irq(s);
411 }
412 }
413
414 static void handle_satn_stop(ESPState *s)
415 {
416 int32_t cmdlen;
417
418 if (s->dma && !s->dma_enabled) {
419 s->dma_cb = handle_satn_stop;
420 return;
421 }
422 s->pdma_cb = satn_stop_pdma_cb;
423 cmdlen = get_cmd(s, 1);
424 if (cmdlen > 0) {
425 trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
426 s->do_cmd = 1;
427 s->cmdfifo_cdb_offset = 1;
428 s->rregs[ESP_RSTAT] = STAT_MO;
429 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
430 s->rregs[ESP_RSEQ] = SEQ_MO;
431 esp_raise_irq(s);
432 } else if (cmdlen == 0) {
433 s->do_cmd = 1;
434 /* Target present, switch to message out phase */
435 s->rregs[ESP_RSEQ] = SEQ_MO;
436 s->rregs[ESP_RSTAT] = STAT_MO;
437 }
438 }
439
440 static void write_response_pdma_cb(ESPState *s)
441 {
442 s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
443 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
444 s->rregs[ESP_RSEQ] = SEQ_CD;
445 esp_raise_irq(s);
446 }
447
448 static void write_response(ESPState *s)
449 {
450 uint8_t buf[2];
451
452 trace_esp_write_response(s->status);
453
454 buf[0] = s->status;
455 buf[1] = 0;
456
457 if (s->dma) {
458 if (s->dma_memory_write) {
459 s->dma_memory_write(s->dma_opaque, buf, 2);
460 s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
461 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
462 s->rregs[ESP_RSEQ] = SEQ_CD;
463 } else {
464 s->pdma_cb = write_response_pdma_cb;
465 esp_raise_drq(s);
466 return;
467 }
468 } else {
469 fifo8_reset(&s->fifo);
470 fifo8_push_all(&s->fifo, buf, 2);
471 s->rregs[ESP_RFLAGS] = 2;
472 }
473 esp_raise_irq(s);
474 }
475
476 static void esp_dma_done(ESPState *s)
477 {
478 s->rregs[ESP_RSTAT] |= STAT_TC;
479 s->rregs[ESP_RINTR] |= INTR_BS;
480 s->rregs[ESP_RSEQ] = 0;
481 s->rregs[ESP_RFLAGS] = 0;
482 esp_set_tc(s, 0);
483 esp_raise_irq(s);
484 }
485
486 static void do_dma_pdma_cb(ESPState *s)
487 {
488 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
489 int len;
490 uint32_t n;
491
492 if (s->do_cmd) {
493 s->ti_size = 0;
494 s->do_cmd = 0;
495 do_cmd(s);
496 esp_lower_drq(s);
497 return;
498 }
499
500 if (!s->current_req) {
501 return;
502 }
503
504 if (to_device) {
505 /* Copy FIFO data to device */
506 len = MIN(s->async_len, ESP_FIFO_SZ);
507 len = MIN(len, fifo8_num_used(&s->fifo));
508 n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
509 s->async_buf += n;
510 s->async_len -= n;
511 s->ti_size += n;
512
513 if (n < len) {
514 /* Unaligned accesses can cause FIFO wraparound */
515 len = len - n;
516 n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
517 s->async_buf += n;
518 s->async_len -= n;
519 s->ti_size += n;
520 }
521
522 if (s->async_len == 0) {
523 scsi_req_continue(s->current_req);
524 return;
525 }
526
527 if (esp_get_tc(s) == 0) {
528 esp_lower_drq(s);
529 esp_dma_done(s);
530 }
531
532 return;
533 } else {
534 if (s->async_len == 0) {
535 /* Defer until the scsi layer has completed */
536 scsi_req_continue(s->current_req);
537 s->data_in_ready = false;
538 return;
539 }
540
541 if (esp_get_tc(s) != 0) {
542 /* Copy device data to FIFO */
543 len = MIN(s->async_len, esp_get_tc(s));
544 len = MIN(len, fifo8_num_free(&s->fifo));
545 fifo8_push_all(&s->fifo, s->async_buf, len);
546 s->async_buf += len;
547 s->async_len -= len;
548 s->ti_size -= len;
549 esp_set_tc(s, esp_get_tc(s) - len);
550
551 if (esp_get_tc(s) == 0) {
552 /* Indicate transfer to FIFO is complete */
553 s->rregs[ESP_RSTAT] |= STAT_TC;
554 }
555 return;
556 }
557
558 /* Partially filled a scsi buffer. Complete immediately. */
559 esp_lower_drq(s);
560 esp_dma_done(s);
561 }
562 }
563
564 static void esp_do_dma(ESPState *s)
565 {
566 uint32_t len, cmdlen;
567 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
568 uint8_t buf[ESP_CMDFIFO_SZ];
569
570 len = esp_get_tc(s);
571 if (s->do_cmd) {
572 /*
573 * handle_ti_cmd() case: esp_do_dma() is called only from
574 * handle_ti_cmd() with do_cmd != NULL (see the assert())
575 */
576 cmdlen = fifo8_num_used(&s->cmdfifo);
577 trace_esp_do_dma(cmdlen, len);
578 if (s->dma_memory_read) {
579 s->dma_memory_read(s->dma_opaque, buf, len);
580 fifo8_push_all(&s->cmdfifo, buf, len);
581 } else {
582 s->pdma_cb = do_dma_pdma_cb;
583 esp_raise_drq(s);
584 return;
585 }
586 trace_esp_handle_ti_cmd(cmdlen);
587 s->ti_size = 0;
588 if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
589 /* No command received */
590 if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
591 return;
592 }
593
594 /* Command has been received */
595 s->do_cmd = 0;
596 do_cmd(s);
597 } else {
598 /*
599 * Extra message out bytes received: update cmdfifo_cdb_offset
600 * and then switch to commmand phase
601 */
602 s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
603 s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
604 s->rregs[ESP_RSEQ] = SEQ_CD;
605 s->rregs[ESP_RINTR] |= INTR_BS;
606 esp_raise_irq(s);
607 }
608 return;
609 }
610 if (!s->current_req) {
611 return;
612 }
613 if (s->async_len == 0) {
614 /* Defer until data is available. */
615 return;
616 }
617 if (len > s->async_len) {
618 len = s->async_len;
619 }
620 if (to_device) {
621 if (s->dma_memory_read) {
622 s->dma_memory_read(s->dma_opaque, s->async_buf, len);
623 } else {
624 s->pdma_cb = do_dma_pdma_cb;
625 esp_raise_drq(s);
626 return;
627 }
628 } else {
629 if (s->dma_memory_write) {
630 s->dma_memory_write(s->dma_opaque, s->async_buf, len);
631 } else {
632 /* Adjust TC for any leftover data in the FIFO */
633 if (!fifo8_is_empty(&s->fifo)) {
634 esp_set_tc(s, esp_get_tc(s) - fifo8_num_used(&s->fifo));
635 }
636
637 /* Copy device data to FIFO */
638 len = MIN(len, fifo8_num_free(&s->fifo));
639 fifo8_push_all(&s->fifo, s->async_buf, len);
640 s->async_buf += len;
641 s->async_len -= len;
642 s->ti_size -= len;
643
644 /*
645 * MacOS toolbox uses a TI length of 16 bytes for all commands, so
646 * commands shorter than this must be padded accordingly
647 */
648 if (len < esp_get_tc(s) && esp_get_tc(s) <= ESP_FIFO_SZ) {
649 while (fifo8_num_used(&s->fifo) < ESP_FIFO_SZ) {
650 esp_fifo_push(&s->fifo, 0);
651 len++;
652 }
653 }
654
655 esp_set_tc(s, esp_get_tc(s) - len);
656 s->pdma_cb = do_dma_pdma_cb;
657 esp_raise_drq(s);
658
659 /* Indicate transfer to FIFO is complete */
660 s->rregs[ESP_RSTAT] |= STAT_TC;
661 return;
662 }
663 }
664 esp_set_tc(s, esp_get_tc(s) - len);
665 s->async_buf += len;
666 s->async_len -= len;
667 if (to_device) {
668 s->ti_size += len;
669 } else {
670 s->ti_size -= len;
671 }
672 if (s->async_len == 0) {
673 scsi_req_continue(s->current_req);
674 /*
675 * If there is still data to be read from the device then
676 * complete the DMA operation immediately. Otherwise defer
677 * until the scsi layer has completed.
678 */
679 if (to_device || esp_get_tc(s) != 0 || s->ti_size == 0) {
680 return;
681 }
682 }
683
684 /* Partially filled a scsi buffer. Complete immediately. */
685 esp_dma_done(s);
686 esp_lower_drq(s);
687 }
688
689 static void esp_do_nodma(ESPState *s)
690 {
691 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
692 uint32_t cmdlen;
693 int len;
694
695 if (s->do_cmd) {
696 cmdlen = fifo8_num_used(&s->cmdfifo);
697 trace_esp_handle_ti_cmd(cmdlen);
698 s->ti_size = 0;
699 if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
700 /* No command received */
701 if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
702 return;
703 }
704
705 /* Command has been received */
706 s->do_cmd = 0;
707 do_cmd(s);
708 } else {
709 /*
710 * Extra message out bytes received: update cmdfifo_cdb_offset
711 * and then switch to commmand phase
712 */
713 s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
714 s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
715 s->rregs[ESP_RSEQ] = SEQ_CD;
716 s->rregs[ESP_RINTR] |= INTR_BS;
717 esp_raise_irq(s);
718 }
719 return;
720 }
721
722 if (!s->current_req) {
723 return;
724 }
725
726 if (s->async_len == 0) {
727 /* Defer until data is available. */
728 return;
729 }
730
731 if (to_device) {
732 len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
733 esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
734 s->async_buf += len;
735 s->async_len -= len;
736 s->ti_size += len;
737 } else {
738 len = MIN(s->ti_size, s->async_len);
739 len = MIN(len, fifo8_num_free(&s->fifo));
740 fifo8_push_all(&s->fifo, s->async_buf, len);
741 s->async_buf += len;
742 s->async_len -= len;
743 s->ti_size -= len;
744 }
745
746 if (s->async_len == 0) {
747 scsi_req_continue(s->current_req);
748
749 if (to_device || s->ti_size == 0) {
750 return;
751 }
752 }
753
754 s->rregs[ESP_RINTR] |= INTR_BS;
755 esp_raise_irq(s);
756 }
757
758 void esp_command_complete(SCSIRequest *req, size_t resid)
759 {
760 ESPState *s = req->hba_private;
761
762 trace_esp_command_complete();
763 if (s->ti_size != 0) {
764 trace_esp_command_complete_unexpected();
765 }
766 s->ti_size = 0;
767 s->async_len = 0;
768 if (req->status) {
769 trace_esp_command_complete_fail();
770 }
771 s->status = req->status;
772 s->rregs[ESP_RSTAT] = STAT_ST;
773 esp_dma_done(s);
774 esp_lower_drq(s);
775 if (s->current_req) {
776 scsi_req_unref(s->current_req);
777 s->current_req = NULL;
778 s->current_dev = NULL;
779 }
780 }
781
782 void esp_transfer_data(SCSIRequest *req, uint32_t len)
783 {
784 ESPState *s = req->hba_private;
785 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
786 uint32_t dmalen = esp_get_tc(s);
787
788 assert(!s->do_cmd);
789 trace_esp_transfer_data(dmalen, s->ti_size);
790 s->async_len = len;
791 s->async_buf = scsi_req_get_buf(req);
792
793 if (!to_device && !s->data_in_ready) {
794 /*
795 * Initial incoming data xfer is complete so raise command
796 * completion interrupt
797 */
798 s->data_in_ready = true;
799 s->rregs[ESP_RSTAT] |= STAT_TC;
800 s->rregs[ESP_RINTR] |= INTR_BS;
801 esp_raise_irq(s);
802
803 /*
804 * If data is ready to transfer and the TI command has already
805 * been executed, start DMA immediately. Otherwise DMA will start
806 * when host sends the TI command
807 */
808 if (s->ti_size && (s->rregs[ESP_CMD] == (CMD_TI | CMD_DMA))) {
809 esp_do_dma(s);
810 }
811 return;
812 }
813
814 if (s->ti_cmd == 0) {
815 /*
816 * Always perform the initial transfer upon reception of the next TI
817 * command to ensure the DMA/non-DMA status of the command is correct.
818 * It is not possible to use s->dma directly in the section below as
819 * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the
820 * async data transfer is delayed then s->dma is set incorrectly.
821 */
822 return;
823 }
824
825 if (s->ti_cmd & CMD_DMA) {
826 if (dmalen) {
827 esp_do_dma(s);
828 } else if (s->ti_size <= 0) {
829 /*
830 * If this was the last part of a DMA transfer then the
831 * completion interrupt is deferred to here.
832 */
833 esp_dma_done(s);
834 esp_lower_drq(s);
835 }
836 } else {
837 esp_do_nodma(s);
838 }
839 }
840
841 static void handle_ti(ESPState *s)
842 {
843 uint32_t dmalen;
844
845 if (s->dma && !s->dma_enabled) {
846 s->dma_cb = handle_ti;
847 return;
848 }
849
850 s->ti_cmd = s->rregs[ESP_CMD];
851 if (s->dma) {
852 dmalen = esp_get_tc(s);
853 trace_esp_handle_ti(dmalen);
854 s->rregs[ESP_RSTAT] &= ~STAT_TC;
855 esp_do_dma(s);
856 } else {
857 trace_esp_handle_ti(s->ti_size);
858 esp_do_nodma(s);
859 }
860 }
861
862 void esp_hard_reset(ESPState *s)
863 {
864 memset(s->rregs, 0, ESP_REGS);
865 memset(s->wregs, 0, ESP_REGS);
866 s->tchi_written = 0;
867 s->ti_size = 0;
868 fifo8_reset(&s->fifo);
869 fifo8_reset(&s->cmdfifo);
870 s->dma = 0;
871 s->do_cmd = 0;
872 s->dma_cb = NULL;
873
874 s->rregs[ESP_CFG1] = 7;
875 }
876
877 static void esp_soft_reset(ESPState *s)
878 {
879 qemu_irq_lower(s->irq);
880 qemu_irq_lower(s->irq_data);
881 esp_hard_reset(s);
882 }
883
884 static void parent_esp_reset(ESPState *s, int irq, int level)
885 {
886 if (level) {
887 esp_soft_reset(s);
888 }
889 }
890
891 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
892 {
893 uint32_t val;
894
895 switch (saddr) {
896 case ESP_FIFO:
897 if (s->dma_memory_read && s->dma_memory_write &&
898 (s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
899 /* Data out. */
900 qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
901 s->rregs[ESP_FIFO] = 0;
902 } else {
903 s->rregs[ESP_FIFO] = esp_fifo_pop(&s->fifo);
904 }
905 val = s->rregs[ESP_FIFO];
906 break;
907 case ESP_RINTR:
908 /*
909 * Clear sequence step, interrupt register and all status bits
910 * except TC
911 */
912 val = s->rregs[ESP_RINTR];
913 s->rregs[ESP_RINTR] = 0;
914 s->rregs[ESP_RSTAT] &= ~STAT_TC;
915 s->rregs[ESP_RSEQ] = SEQ_0;
916 esp_lower_irq(s);
917 break;
918 case ESP_TCHI:
919 /* Return the unique id if the value has never been written */
920 if (!s->tchi_written) {
921 val = s->chip_id;
922 } else {
923 val = s->rregs[saddr];
924 }
925 break;
926 case ESP_RFLAGS:
927 /* Bottom 5 bits indicate number of bytes in FIFO */
928 val = fifo8_num_used(&s->fifo);
929 break;
930 default:
931 val = s->rregs[saddr];
932 break;
933 }
934
935 trace_esp_mem_readb(saddr, val);
936 return val;
937 }
938
939 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
940 {
941 trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
942 switch (saddr) {
943 case ESP_TCHI:
944 s->tchi_written = true;
945 /* fall through */
946 case ESP_TCLO:
947 case ESP_TCMID:
948 s->rregs[ESP_RSTAT] &= ~STAT_TC;
949 break;
950 case ESP_FIFO:
951 if (s->do_cmd) {
952 esp_fifo_push(&s->cmdfifo, val);
953 } else {
954 esp_fifo_push(&s->fifo, val);
955 }
956
957 /* Non-DMA transfers raise an interrupt after every byte */
958 if (s->rregs[ESP_CMD] == CMD_TI) {
959 s->rregs[ESP_RINTR] |= INTR_FC | INTR_BS;
960 esp_raise_irq(s);
961 }
962 break;
963 case ESP_CMD:
964 s->rregs[saddr] = val;
965 if (val & CMD_DMA) {
966 s->dma = 1;
967 /* Reload DMA counter. */
968 if (esp_get_stc(s) == 0) {
969 esp_set_tc(s, 0x10000);
970 } else {
971 esp_set_tc(s, esp_get_stc(s));
972 }
973 } else {
974 s->dma = 0;
975 }
976 switch (val & CMD_CMD) {
977 case CMD_NOP:
978 trace_esp_mem_writeb_cmd_nop(val);
979 break;
980 case CMD_FLUSH:
981 trace_esp_mem_writeb_cmd_flush(val);
982 fifo8_reset(&s->fifo);
983 break;
984 case CMD_RESET:
985 trace_esp_mem_writeb_cmd_reset(val);
986 esp_soft_reset(s);
987 break;
988 case CMD_BUSRESET:
989 trace_esp_mem_writeb_cmd_bus_reset(val);
990 if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
991 s->rregs[ESP_RINTR] |= INTR_RST;
992 esp_raise_irq(s);
993 }
994 break;
995 case CMD_TI:
996 trace_esp_mem_writeb_cmd_ti(val);
997 handle_ti(s);
998 break;
999 case CMD_ICCS:
1000 trace_esp_mem_writeb_cmd_iccs(val);
1001 write_response(s);
1002 s->rregs[ESP_RINTR] |= INTR_FC;
1003 s->rregs[ESP_RSTAT] |= STAT_MI;
1004 break;
1005 case CMD_MSGACC:
1006 trace_esp_mem_writeb_cmd_msgacc(val);
1007 s->rregs[ESP_RINTR] |= INTR_DC;
1008 s->rregs[ESP_RSEQ] = 0;
1009 s->rregs[ESP_RFLAGS] = 0;
1010 esp_raise_irq(s);
1011 break;
1012 case CMD_PAD:
1013 trace_esp_mem_writeb_cmd_pad(val);
1014 s->rregs[ESP_RSTAT] = STAT_TC;
1015 s->rregs[ESP_RINTR] |= INTR_FC;
1016 s->rregs[ESP_RSEQ] = 0;
1017 break;
1018 case CMD_SATN:
1019 trace_esp_mem_writeb_cmd_satn(val);
1020 break;
1021 case CMD_RSTATN:
1022 trace_esp_mem_writeb_cmd_rstatn(val);
1023 break;
1024 case CMD_SEL:
1025 trace_esp_mem_writeb_cmd_sel(val);
1026 handle_s_without_atn(s);
1027 break;
1028 case CMD_SELATN:
1029 trace_esp_mem_writeb_cmd_selatn(val);
1030 handle_satn(s);
1031 break;
1032 case CMD_SELATNS:
1033 trace_esp_mem_writeb_cmd_selatns(val);
1034 handle_satn_stop(s);
1035 break;
1036 case CMD_ENSEL:
1037 trace_esp_mem_writeb_cmd_ensel(val);
1038 s->rregs[ESP_RINTR] = 0;
1039 break;
1040 case CMD_DISSEL:
1041 trace_esp_mem_writeb_cmd_dissel(val);
1042 s->rregs[ESP_RINTR] = 0;
1043 esp_raise_irq(s);
1044 break;
1045 default:
1046 trace_esp_error_unhandled_command(val);
1047 break;
1048 }
1049 break;
1050 case ESP_WBUSID ... ESP_WSYNO:
1051 break;
1052 case ESP_CFG1:
1053 case ESP_CFG2: case ESP_CFG3:
1054 case ESP_RES3: case ESP_RES4:
1055 s->rregs[saddr] = val;
1056 break;
1057 case ESP_WCCF ... ESP_WTEST:
1058 break;
1059 default:
1060 trace_esp_error_invalid_write(val, saddr);
1061 return;
1062 }
1063 s->wregs[saddr] = val;
1064 }
1065
1066 static bool esp_mem_accepts(void *opaque, hwaddr addr,
1067 unsigned size, bool is_write,
1068 MemTxAttrs attrs)
1069 {
1070 return (size == 1) || (is_write && size == 4);
1071 }
1072
1073 static bool esp_is_before_version_5(void *opaque, int version_id)
1074 {
1075 ESPState *s = ESP(opaque);
1076
1077 version_id = MIN(version_id, s->mig_version_id);
1078 return version_id < 5;
1079 }
1080
1081 static bool esp_is_version_5(void *opaque, int version_id)
1082 {
1083 ESPState *s = ESP(opaque);
1084
1085 version_id = MIN(version_id, s->mig_version_id);
1086 return version_id == 5;
1087 }
1088
1089 int esp_pre_save(void *opaque)
1090 {
1091 ESPState *s = ESP(object_resolve_path_component(
1092 OBJECT(opaque), "esp"));
1093
1094 s->mig_version_id = vmstate_esp.version_id;
1095 return 0;
1096 }
1097
1098 static int esp_post_load(void *opaque, int version_id)
1099 {
1100 ESPState *s = ESP(opaque);
1101 int len, i;
1102
1103 version_id = MIN(version_id, s->mig_version_id);
1104
1105 if (version_id < 5) {
1106 esp_set_tc(s, s->mig_dma_left);
1107
1108 /* Migrate ti_buf to fifo */
1109 len = s->mig_ti_wptr - s->mig_ti_rptr;
1110 for (i = 0; i < len; i++) {
1111 fifo8_push(&s->fifo, s->mig_ti_buf[i]);
1112 }
1113
1114 /* Migrate cmdbuf to cmdfifo */
1115 for (i = 0; i < s->mig_cmdlen; i++) {
1116 fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
1117 }
1118 }
1119
1120 s->mig_version_id = vmstate_esp.version_id;
1121 return 0;
1122 }
1123
1124 const VMStateDescription vmstate_esp = {
1125 .name = "esp",
1126 .version_id = 5,
1127 .minimum_version_id = 3,
1128 .post_load = esp_post_load,
1129 .fields = (VMStateField[]) {
1130 VMSTATE_BUFFER(rregs, ESPState),
1131 VMSTATE_BUFFER(wregs, ESPState),
1132 VMSTATE_INT32(ti_size, ESPState),
1133 VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5),
1134 VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5),
1135 VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5),
1136 VMSTATE_UINT32(status, ESPState),
1137 VMSTATE_UINT32_TEST(mig_deferred_status, ESPState,
1138 esp_is_before_version_5),
1139 VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState,
1140 esp_is_before_version_5),
1141 VMSTATE_UINT32(dma, ESPState),
1142 VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0,
1143 esp_is_before_version_5, 0, 16),
1144 VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4,
1145 esp_is_before_version_5, 16,
1146 sizeof(typeof_field(ESPState, mig_cmdbuf))),
1147 VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5),
1148 VMSTATE_UINT32(do_cmd, ESPState),
1149 VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5),
1150 VMSTATE_BOOL_TEST(data_in_ready, ESPState, esp_is_version_5),
1151 VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5),
1152 VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5),
1153 VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5),
1154 VMSTATE_UINT8_TEST(ti_cmd, ESPState, esp_is_version_5),
1155 VMSTATE_END_OF_LIST()
1156 },
1157 };
1158
1159 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
1160 uint64_t val, unsigned int size)
1161 {
1162 SysBusESPState *sysbus = opaque;
1163 ESPState *s = ESP(&sysbus->esp);
1164 uint32_t saddr;
1165
1166 saddr = addr >> sysbus->it_shift;
1167 esp_reg_write(s, saddr, val);
1168 }
1169
1170 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
1171 unsigned int size)
1172 {
1173 SysBusESPState *sysbus = opaque;
1174 ESPState *s = ESP(&sysbus->esp);
1175 uint32_t saddr;
1176
1177 saddr = addr >> sysbus->it_shift;
1178 return esp_reg_read(s, saddr);
1179 }
1180
1181 static const MemoryRegionOps sysbus_esp_mem_ops = {
1182 .read = sysbus_esp_mem_read,
1183 .write = sysbus_esp_mem_write,
1184 .endianness = DEVICE_NATIVE_ENDIAN,
1185 .valid.accepts = esp_mem_accepts,
1186 };
1187
1188 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
1189 uint64_t val, unsigned int size)
1190 {
1191 SysBusESPState *sysbus = opaque;
1192 ESPState *s = ESP(&sysbus->esp);
1193 uint32_t dmalen;
1194
1195 trace_esp_pdma_write(size);
1196
1197 switch (size) {
1198 case 1:
1199 esp_pdma_write(s, val);
1200 break;
1201 case 2:
1202 esp_pdma_write(s, val >> 8);
1203 esp_pdma_write(s, val);
1204 break;
1205 }
1206 dmalen = esp_get_tc(s);
1207 if (dmalen == 0 || fifo8_num_free(&s->fifo) < 2) {
1208 s->pdma_cb(s);
1209 }
1210 }
1211
1212 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
1213 unsigned int size)
1214 {
1215 SysBusESPState *sysbus = opaque;
1216 ESPState *s = ESP(&sysbus->esp);
1217 uint64_t val = 0;
1218
1219 trace_esp_pdma_read(size);
1220
1221 switch (size) {
1222 case 1:
1223 val = esp_pdma_read(s);
1224 break;
1225 case 2:
1226 val = esp_pdma_read(s);
1227 val = (val << 8) | esp_pdma_read(s);
1228 break;
1229 }
1230 if (fifo8_num_used(&s->fifo) < 2) {
1231 s->pdma_cb(s);
1232 }
1233 return val;
1234 }
1235
1236 static const MemoryRegionOps sysbus_esp_pdma_ops = {
1237 .read = sysbus_esp_pdma_read,
1238 .write = sysbus_esp_pdma_write,
1239 .endianness = DEVICE_NATIVE_ENDIAN,
1240 .valid.min_access_size = 1,
1241 .valid.max_access_size = 4,
1242 .impl.min_access_size = 1,
1243 .impl.max_access_size = 2,
1244 };
1245
1246 static const struct SCSIBusInfo esp_scsi_info = {
1247 .tcq = false,
1248 .max_target = ESP_MAX_DEVS,
1249 .max_lun = 7,
1250
1251 .transfer_data = esp_transfer_data,
1252 .complete = esp_command_complete,
1253 .cancel = esp_request_cancelled
1254 };
1255
1256 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
1257 {
1258 SysBusESPState *sysbus = SYSBUS_ESP(opaque);
1259 ESPState *s = ESP(&sysbus->esp);
1260
1261 switch (irq) {
1262 case 0:
1263 parent_esp_reset(s, irq, level);
1264 break;
1265 case 1:
1266 esp_dma_enable(opaque, irq, level);
1267 break;
1268 }
1269 }
1270
1271 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
1272 {
1273 SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1274 SysBusESPState *sysbus = SYSBUS_ESP(dev);
1275 ESPState *s = ESP(&sysbus->esp);
1276
1277 if (!qdev_realize(DEVICE(s), NULL, errp)) {
1278 return;
1279 }
1280
1281 sysbus_init_irq(sbd, &s->irq);
1282 sysbus_init_irq(sbd, &s->irq_data);
1283 assert(sysbus->it_shift != -1);
1284
1285 s->chip_id = TCHI_FAS100A;
1286 memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
1287 sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
1288 sysbus_init_mmio(sbd, &sysbus->iomem);
1289 memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
1290 sysbus, "esp-pdma", 4);
1291 sysbus_init_mmio(sbd, &sysbus->pdma);
1292
1293 qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
1294
1295 scsi_bus_new(&s->bus, sizeof(s->bus), dev, &esp_scsi_info, NULL);
1296 }
1297
1298 static void sysbus_esp_hard_reset(DeviceState *dev)
1299 {
1300 SysBusESPState *sysbus = SYSBUS_ESP(dev);
1301 ESPState *s = ESP(&sysbus->esp);
1302
1303 esp_hard_reset(s);
1304 }
1305
1306 static void sysbus_esp_init(Object *obj)
1307 {
1308 SysBusESPState *sysbus = SYSBUS_ESP(obj);
1309
1310 object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
1311 }
1312
1313 static const VMStateDescription vmstate_sysbus_esp_scsi = {
1314 .name = "sysbusespscsi",
1315 .version_id = 2,
1316 .minimum_version_id = 1,
1317 .pre_save = esp_pre_save,
1318 .fields = (VMStateField[]) {
1319 VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
1320 VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
1321 VMSTATE_END_OF_LIST()
1322 }
1323 };
1324
1325 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
1326 {
1327 DeviceClass *dc = DEVICE_CLASS(klass);
1328
1329 dc->realize = sysbus_esp_realize;
1330 dc->reset = sysbus_esp_hard_reset;
1331 dc->vmsd = &vmstate_sysbus_esp_scsi;
1332 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1333 }
1334
1335 static const TypeInfo sysbus_esp_info = {
1336 .name = TYPE_SYSBUS_ESP,
1337 .parent = TYPE_SYS_BUS_DEVICE,
1338 .instance_init = sysbus_esp_init,
1339 .instance_size = sizeof(SysBusESPState),
1340 .class_init = sysbus_esp_class_init,
1341 };
1342
1343 static void esp_finalize(Object *obj)
1344 {
1345 ESPState *s = ESP(obj);
1346
1347 fifo8_destroy(&s->fifo);
1348 fifo8_destroy(&s->cmdfifo);
1349 }
1350
1351 static void esp_init(Object *obj)
1352 {
1353 ESPState *s = ESP(obj);
1354
1355 fifo8_create(&s->fifo, ESP_FIFO_SZ);
1356 fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ);
1357 }
1358
1359 static void esp_class_init(ObjectClass *klass, void *data)
1360 {
1361 DeviceClass *dc = DEVICE_CLASS(klass);
1362
1363 /* internal device for sysbusesp/pciespscsi, not user-creatable */
1364 dc->user_creatable = false;
1365 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1366 }
1367
1368 static const TypeInfo esp_info = {
1369 .name = TYPE_ESP,
1370 .parent = TYPE_DEVICE,
1371 .instance_init = esp_init,
1372 .instance_finalize = esp_finalize,
1373 .instance_size = sizeof(ESPState),
1374 .class_init = esp_class_init,
1375 };
1376
1377 static void esp_register_types(void)
1378 {
1379 type_register_static(&sysbus_esp_info);
1380 type_register_static(&esp_info);
1381 }
1382
1383 type_init(esp_register_types)