1 /* 2 * QEMU ESP/NCR53C9x emulation 3 * 4 * Copyright (c) 2005-2006 Fabrice Bellard 5 * Copyright (c) 2012 Herve Poussineau 6 * 7 * Permission is hereby granted, free of charge, to any person obtaining a copy 8 * of this software and associated documentation files (the "Software"), to deal 9 * in the Software without restriction, including without limitation the rights 10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 11 * copies of the Software, and to permit persons to whom the Software is 12 * furnished to do so, subject to the following conditions: 13 * 14 * The above copyright notice and this permission notice shall be included in 15 * all copies or substantial portions of the Software. 16 * 17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 23 * THE SOFTWARE. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "hw/sysbus.h" 28 #include "migration/vmstate.h" 29 #include "hw/irq.h" 30 #include "hw/scsi/esp.h" 31 #include "trace.h" 32 #include "qemu/log.h" 33 #include "qemu/module.h" 34 35 /* 36 * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O), 37 * also produced as NCR89C100. See 38 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt 39 * and 40 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt 41 * 42 * On Macintosh Quadra it is a NCR53C96. 43 */ 44 45 static void esp_raise_irq(ESPState *s) 46 { 47 if (!(s->rregs[ESP_RSTAT] & STAT_INT)) { 48 s->rregs[ESP_RSTAT] |= STAT_INT; 49 qemu_irq_raise(s->irq); 50 trace_esp_raise_irq(); 51 } 52 } 53 54 static void esp_lower_irq(ESPState *s) 55 { 56 if (s->rregs[ESP_RSTAT] & STAT_INT) { 57 s->rregs[ESP_RSTAT] &= ~STAT_INT; 58 qemu_irq_lower(s->irq); 59 trace_esp_lower_irq(); 60 } 61 } 62 63 static void esp_raise_drq(ESPState *s) 64 { 65 qemu_irq_raise(s->irq_data); 66 trace_esp_raise_drq(); 67 } 68 69 static void esp_lower_drq(ESPState *s) 70 { 71 qemu_irq_lower(s->irq_data); 72 trace_esp_lower_drq(); 73 } 74 75 void esp_dma_enable(ESPState *s, int irq, int level) 76 { 77 if (level) { 78 s->dma_enabled = 1; 79 trace_esp_dma_enable(); 80 if (s->dma_cb) { 81 s->dma_cb(s); 82 s->dma_cb = NULL; 83 } 84 } else { 85 trace_esp_dma_disable(); 86 s->dma_enabled = 0; 87 } 88 } 89 90 void esp_request_cancelled(SCSIRequest *req) 91 { 92 ESPState *s = req->hba_private; 93 94 if (req == s->current_req) { 95 scsi_req_unref(s->current_req); 96 s->current_req = NULL; 97 s->current_dev = NULL; 98 } 99 } 100 101 static void esp_fifo_push(Fifo8 *fifo, uint8_t val) 102 { 103 if (fifo8_num_used(fifo) == fifo->capacity) { 104 trace_esp_error_fifo_overrun(); 105 return; 106 } 107 108 fifo8_push(fifo, val); 109 } 110 111 static uint8_t esp_fifo_pop(Fifo8 *fifo) 112 { 113 if (fifo8_is_empty(fifo)) { 114 return 0; 115 } 116 117 return fifo8_pop(fifo); 118 } 119 120 static uint32_t esp_fifo_pop_buf(Fifo8 *fifo, uint8_t *dest, int maxlen) 121 { 122 const uint8_t *buf; 123 uint32_t n; 124 125 if (maxlen == 0) { 126 return 0; 127 } 128 129 buf = fifo8_pop_buf(fifo, maxlen, &n); 130 if (dest) { 131 memcpy(dest, buf, n); 132 } 133 134 return n; 135 } 136 137 static uint32_t esp_get_tc(ESPState *s) 138 { 139 uint32_t dmalen; 140 141 dmalen = s->rregs[ESP_TCLO]; 142 dmalen |= s->rregs[ESP_TCMID] << 8; 143 dmalen |= s->rregs[ESP_TCHI] << 16; 144 145 return dmalen; 146 } 147 148 static void esp_set_tc(ESPState *s, uint32_t dmalen) 149 { 150 s->rregs[ESP_TCLO] = dmalen; 151 s->rregs[ESP_TCMID] = dmalen >> 8; 152 s->rregs[ESP_TCHI] = dmalen >> 16; 153 } 154 155 static uint32_t esp_get_stc(ESPState *s) 156 { 157 uint32_t dmalen; 158 159 dmalen = s->wregs[ESP_TCLO]; 160 dmalen |= s->wregs[ESP_TCMID] << 8; 161 dmalen |= s->wregs[ESP_TCHI] << 16; 162 163 return dmalen; 164 } 165 166 static uint8_t esp_pdma_read(ESPState *s) 167 { 168 uint8_t val; 169 170 if (s->do_cmd) { 171 val = esp_fifo_pop(&s->cmdfifo); 172 } else { 173 val = esp_fifo_pop(&s->fifo); 174 } 175 176 return val; 177 } 178 179 static void esp_pdma_write(ESPState *s, uint8_t val) 180 { 181 uint32_t dmalen = esp_get_tc(s); 182 183 if (dmalen == 0) { 184 return; 185 } 186 187 if (s->do_cmd) { 188 esp_fifo_push(&s->cmdfifo, val); 189 } else { 190 esp_fifo_push(&s->fifo, val); 191 } 192 193 dmalen--; 194 esp_set_tc(s, dmalen); 195 } 196 197 static int esp_select(ESPState *s) 198 { 199 int target; 200 201 target = s->wregs[ESP_WBUSID] & BUSID_DID; 202 203 s->ti_size = 0; 204 fifo8_reset(&s->fifo); 205 206 if (s->current_req) { 207 /* Started a new command before the old one finished. Cancel it. */ 208 scsi_req_cancel(s->current_req); 209 s->async_len = 0; 210 } 211 212 s->current_dev = scsi_device_find(&s->bus, 0, target, 0); 213 if (!s->current_dev) { 214 /* No such drive */ 215 s->rregs[ESP_RSTAT] = 0; 216 s->rregs[ESP_RINTR] |= INTR_DC; 217 s->rregs[ESP_RSEQ] = SEQ_0; 218 esp_raise_irq(s); 219 return -1; 220 } 221 222 /* 223 * Note that we deliberately don't raise the IRQ here: this will be done 224 * either in do_busid_cmd() for DATA OUT transfers or by the deferred 225 * IRQ mechanism in esp_transfer_data() for DATA IN transfers 226 */ 227 s->rregs[ESP_RINTR] |= INTR_FC; 228 s->rregs[ESP_RSEQ] = SEQ_CD; 229 return 0; 230 } 231 232 static uint32_t get_cmd(ESPState *s, uint32_t maxlen) 233 { 234 uint8_t buf[ESP_CMDFIFO_SZ]; 235 uint32_t dmalen, n; 236 int target; 237 238 target = s->wregs[ESP_WBUSID] & BUSID_DID; 239 if (s->dma) { 240 dmalen = MIN(esp_get_tc(s), maxlen); 241 if (dmalen == 0) { 242 return 0; 243 } 244 if (s->dma_memory_read) { 245 s->dma_memory_read(s->dma_opaque, buf, dmalen); 246 fifo8_push_all(&s->cmdfifo, buf, dmalen); 247 } else { 248 if (esp_select(s) < 0) { 249 fifo8_reset(&s->cmdfifo); 250 return -1; 251 } 252 esp_raise_drq(s); 253 fifo8_reset(&s->cmdfifo); 254 return 0; 255 } 256 } else { 257 dmalen = MIN(fifo8_num_used(&s->fifo), maxlen); 258 if (dmalen == 0) { 259 return 0; 260 } 261 n = esp_fifo_pop_buf(&s->fifo, buf, dmalen); 262 if (n >= 3) { 263 buf[0] = buf[2] >> 5; 264 } 265 fifo8_push_all(&s->cmdfifo, buf, n); 266 } 267 trace_esp_get_cmd(dmalen, target); 268 269 if (esp_select(s) < 0) { 270 fifo8_reset(&s->cmdfifo); 271 return -1; 272 } 273 return dmalen; 274 } 275 276 static void do_busid_cmd(ESPState *s, uint8_t busid) 277 { 278 uint32_t cmdlen; 279 int32_t datalen; 280 int lun; 281 SCSIDevice *current_lun; 282 uint8_t buf[ESP_CMDFIFO_SZ]; 283 284 trace_esp_do_busid_cmd(busid); 285 lun = busid & 7; 286 cmdlen = fifo8_num_used(&s->cmdfifo); 287 if (!cmdlen || !s->current_dev) { 288 return; 289 } 290 esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen); 291 292 current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, lun); 293 s->current_req = scsi_req_new(current_lun, 0, lun, buf, s); 294 datalen = scsi_req_enqueue(s->current_req); 295 s->ti_size = datalen; 296 fifo8_reset(&s->cmdfifo); 297 if (datalen != 0) { 298 s->rregs[ESP_RSTAT] = STAT_TC; 299 s->rregs[ESP_RSEQ] = SEQ_CD; 300 s->ti_cmd = 0; 301 esp_set_tc(s, 0); 302 if (datalen > 0) { 303 /* 304 * Switch to DATA IN phase but wait until initial data xfer is 305 * complete before raising the command completion interrupt 306 */ 307 s->data_in_ready = false; 308 s->rregs[ESP_RSTAT] |= STAT_DI; 309 } else { 310 s->rregs[ESP_RSTAT] |= STAT_DO; 311 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC; 312 esp_raise_irq(s); 313 esp_lower_drq(s); 314 } 315 scsi_req_continue(s->current_req); 316 return; 317 } 318 } 319 320 static void do_cmd(ESPState *s) 321 { 322 uint8_t busid = esp_fifo_pop(&s->cmdfifo); 323 int len; 324 325 s->cmdfifo_cdb_offset--; 326 327 /* Ignore extended messages for now */ 328 if (s->cmdfifo_cdb_offset) { 329 len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo)); 330 esp_fifo_pop_buf(&s->cmdfifo, NULL, len); 331 s->cmdfifo_cdb_offset = 0; 332 } 333 334 do_busid_cmd(s, busid); 335 } 336 337 static void satn_pdma_cb(ESPState *s) 338 { 339 s->do_cmd = 0; 340 if (!fifo8_is_empty(&s->cmdfifo)) { 341 s->cmdfifo_cdb_offset = 1; 342 do_cmd(s); 343 } 344 } 345 346 static void handle_satn(ESPState *s) 347 { 348 int32_t cmdlen; 349 350 if (s->dma && !s->dma_enabled) { 351 s->dma_cb = handle_satn; 352 return; 353 } 354 s->pdma_cb = satn_pdma_cb; 355 cmdlen = get_cmd(s, ESP_CMDFIFO_SZ); 356 if (cmdlen > 0) { 357 s->cmdfifo_cdb_offset = 1; 358 do_cmd(s); 359 } else if (cmdlen == 0) { 360 s->do_cmd = 1; 361 /* Target present, but no cmd yet - switch to command phase */ 362 s->rregs[ESP_RSEQ] = SEQ_CD; 363 s->rregs[ESP_RSTAT] = STAT_CD; 364 } 365 } 366 367 static void s_without_satn_pdma_cb(ESPState *s) 368 { 369 uint32_t len; 370 371 s->do_cmd = 0; 372 len = fifo8_num_used(&s->cmdfifo); 373 if (len) { 374 s->cmdfifo_cdb_offset = 0; 375 do_busid_cmd(s, 0); 376 } 377 } 378 379 static void handle_s_without_atn(ESPState *s) 380 { 381 int32_t cmdlen; 382 383 if (s->dma && !s->dma_enabled) { 384 s->dma_cb = handle_s_without_atn; 385 return; 386 } 387 s->pdma_cb = s_without_satn_pdma_cb; 388 cmdlen = get_cmd(s, ESP_CMDFIFO_SZ); 389 if (cmdlen > 0) { 390 s->cmdfifo_cdb_offset = 0; 391 do_busid_cmd(s, 0); 392 } else if (cmdlen == 0) { 393 s->do_cmd = 1; 394 /* Target present, but no cmd yet - switch to command phase */ 395 s->rregs[ESP_RSEQ] = SEQ_CD; 396 s->rregs[ESP_RSTAT] = STAT_CD; 397 } 398 } 399 400 static void satn_stop_pdma_cb(ESPState *s) 401 { 402 s->do_cmd = 0; 403 if (!fifo8_is_empty(&s->cmdfifo)) { 404 trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo)); 405 s->do_cmd = 1; 406 s->cmdfifo_cdb_offset = 1; 407 s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD; 408 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC; 409 s->rregs[ESP_RSEQ] = SEQ_CD; 410 esp_raise_irq(s); 411 } 412 } 413 414 static void handle_satn_stop(ESPState *s) 415 { 416 int32_t cmdlen; 417 418 if (s->dma && !s->dma_enabled) { 419 s->dma_cb = handle_satn_stop; 420 return; 421 } 422 s->pdma_cb = satn_stop_pdma_cb; 423 cmdlen = get_cmd(s, 1); 424 if (cmdlen > 0) { 425 trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo)); 426 s->do_cmd = 1; 427 s->cmdfifo_cdb_offset = 1; 428 s->rregs[ESP_RSTAT] = STAT_MO; 429 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC; 430 s->rregs[ESP_RSEQ] = SEQ_MO; 431 esp_raise_irq(s); 432 } else if (cmdlen == 0) { 433 s->do_cmd = 1; 434 /* Target present, switch to message out phase */ 435 s->rregs[ESP_RSEQ] = SEQ_MO; 436 s->rregs[ESP_RSTAT] = STAT_MO; 437 } 438 } 439 440 static void write_response_pdma_cb(ESPState *s) 441 { 442 s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST; 443 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC; 444 s->rregs[ESP_RSEQ] = SEQ_CD; 445 esp_raise_irq(s); 446 } 447 448 static void write_response(ESPState *s) 449 { 450 uint8_t buf[2]; 451 452 trace_esp_write_response(s->status); 453 454 buf[0] = s->status; 455 buf[1] = 0; 456 457 if (s->dma) { 458 if (s->dma_memory_write) { 459 s->dma_memory_write(s->dma_opaque, buf, 2); 460 s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST; 461 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC; 462 s->rregs[ESP_RSEQ] = SEQ_CD; 463 } else { 464 s->pdma_cb = write_response_pdma_cb; 465 esp_raise_drq(s); 466 return; 467 } 468 } else { 469 fifo8_reset(&s->fifo); 470 fifo8_push_all(&s->fifo, buf, 2); 471 s->rregs[ESP_RFLAGS] = 2; 472 } 473 esp_raise_irq(s); 474 } 475 476 static void esp_dma_done(ESPState *s) 477 { 478 s->rregs[ESP_RSTAT] |= STAT_TC; 479 s->rregs[ESP_RINTR] |= INTR_BS; 480 s->rregs[ESP_RSEQ] = 0; 481 s->rregs[ESP_RFLAGS] = 0; 482 esp_set_tc(s, 0); 483 esp_raise_irq(s); 484 } 485 486 static void do_dma_pdma_cb(ESPState *s) 487 { 488 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO); 489 int len; 490 uint32_t n; 491 492 if (s->do_cmd) { 493 s->ti_size = 0; 494 s->do_cmd = 0; 495 do_cmd(s); 496 esp_lower_drq(s); 497 return; 498 } 499 500 if (!s->current_req) { 501 return; 502 } 503 504 if (to_device) { 505 /* Copy FIFO data to device */ 506 len = MIN(s->async_len, ESP_FIFO_SZ); 507 len = MIN(len, fifo8_num_used(&s->fifo)); 508 n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len); 509 s->async_buf += n; 510 s->async_len -= n; 511 s->ti_size += n; 512 513 if (n < len) { 514 /* Unaligned accesses can cause FIFO wraparound */ 515 len = len - n; 516 n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len); 517 s->async_buf += n; 518 s->async_len -= n; 519 s->ti_size += n; 520 } 521 522 if (s->async_len == 0) { 523 scsi_req_continue(s->current_req); 524 return; 525 } 526 527 if (esp_get_tc(s) == 0) { 528 esp_lower_drq(s); 529 esp_dma_done(s); 530 } 531 532 return; 533 } else { 534 if (s->async_len == 0) { 535 /* Defer until the scsi layer has completed */ 536 scsi_req_continue(s->current_req); 537 s->data_in_ready = false; 538 return; 539 } 540 541 if (esp_get_tc(s) != 0) { 542 /* Copy device data to FIFO */ 543 len = MIN(s->async_len, esp_get_tc(s)); 544 len = MIN(len, fifo8_num_free(&s->fifo)); 545 fifo8_push_all(&s->fifo, s->async_buf, len); 546 s->async_buf += len; 547 s->async_len -= len; 548 s->ti_size -= len; 549 esp_set_tc(s, esp_get_tc(s) - len); 550 551 if (esp_get_tc(s) == 0) { 552 /* Indicate transfer to FIFO is complete */ 553 s->rregs[ESP_RSTAT] |= STAT_TC; 554 } 555 return; 556 } 557 558 /* Partially filled a scsi buffer. Complete immediately. */ 559 esp_lower_drq(s); 560 esp_dma_done(s); 561 } 562 } 563 564 static void esp_do_dma(ESPState *s) 565 { 566 uint32_t len, cmdlen; 567 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO); 568 uint8_t buf[ESP_CMDFIFO_SZ]; 569 570 len = esp_get_tc(s); 571 if (s->do_cmd) { 572 /* 573 * handle_ti_cmd() case: esp_do_dma() is called only from 574 * handle_ti_cmd() with do_cmd != NULL (see the assert()) 575 */ 576 cmdlen = fifo8_num_used(&s->cmdfifo); 577 trace_esp_do_dma(cmdlen, len); 578 if (s->dma_memory_read) { 579 s->dma_memory_read(s->dma_opaque, buf, len); 580 fifo8_push_all(&s->cmdfifo, buf, len); 581 } else { 582 s->pdma_cb = do_dma_pdma_cb; 583 esp_raise_drq(s); 584 return; 585 } 586 trace_esp_handle_ti_cmd(cmdlen); 587 s->ti_size = 0; 588 if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) { 589 /* No command received */ 590 if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) { 591 return; 592 } 593 594 /* Command has been received */ 595 s->do_cmd = 0; 596 do_cmd(s); 597 } else { 598 /* 599 * Extra message out bytes received: update cmdfifo_cdb_offset 600 * and then switch to commmand phase 601 */ 602 s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo); 603 s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD; 604 s->rregs[ESP_RSEQ] = SEQ_CD; 605 s->rregs[ESP_RINTR] |= INTR_BS; 606 esp_raise_irq(s); 607 } 608 return; 609 } 610 if (!s->current_req) { 611 return; 612 } 613 if (s->async_len == 0) { 614 /* Defer until data is available. */ 615 return; 616 } 617 if (len > s->async_len) { 618 len = s->async_len; 619 } 620 if (to_device) { 621 if (s->dma_memory_read) { 622 s->dma_memory_read(s->dma_opaque, s->async_buf, len); 623 } else { 624 s->pdma_cb = do_dma_pdma_cb; 625 esp_raise_drq(s); 626 return; 627 } 628 } else { 629 if (s->dma_memory_write) { 630 s->dma_memory_write(s->dma_opaque, s->async_buf, len); 631 } else { 632 /* Adjust TC for any leftover data in the FIFO */ 633 if (!fifo8_is_empty(&s->fifo)) { 634 esp_set_tc(s, esp_get_tc(s) - fifo8_num_used(&s->fifo)); 635 } 636 637 /* Copy device data to FIFO */ 638 len = MIN(len, fifo8_num_free(&s->fifo)); 639 fifo8_push_all(&s->fifo, s->async_buf, len); 640 s->async_buf += len; 641 s->async_len -= len; 642 s->ti_size -= len; 643 644 /* 645 * MacOS toolbox uses a TI length of 16 bytes for all commands, so 646 * commands shorter than this must be padded accordingly 647 */ 648 if (len < esp_get_tc(s) && esp_get_tc(s) <= ESP_FIFO_SZ) { 649 while (fifo8_num_used(&s->fifo) < ESP_FIFO_SZ) { 650 esp_fifo_push(&s->fifo, 0); 651 len++; 652 } 653 } 654 655 esp_set_tc(s, esp_get_tc(s) - len); 656 s->pdma_cb = do_dma_pdma_cb; 657 esp_raise_drq(s); 658 659 /* Indicate transfer to FIFO is complete */ 660 s->rregs[ESP_RSTAT] |= STAT_TC; 661 return; 662 } 663 } 664 esp_set_tc(s, esp_get_tc(s) - len); 665 s->async_buf += len; 666 s->async_len -= len; 667 if (to_device) { 668 s->ti_size += len; 669 } else { 670 s->ti_size -= len; 671 } 672 if (s->async_len == 0) { 673 scsi_req_continue(s->current_req); 674 /* 675 * If there is still data to be read from the device then 676 * complete the DMA operation immediately. Otherwise defer 677 * until the scsi layer has completed. 678 */ 679 if (to_device || esp_get_tc(s) != 0 || s->ti_size == 0) { 680 return; 681 } 682 } 683 684 /* Partially filled a scsi buffer. Complete immediately. */ 685 esp_dma_done(s); 686 esp_lower_drq(s); 687 } 688 689 static void esp_do_nodma(ESPState *s) 690 { 691 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO); 692 uint32_t cmdlen; 693 int len; 694 695 if (s->do_cmd) { 696 cmdlen = fifo8_num_used(&s->cmdfifo); 697 trace_esp_handle_ti_cmd(cmdlen); 698 s->ti_size = 0; 699 if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) { 700 /* No command received */ 701 if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) { 702 return; 703 } 704 705 /* Command has been received */ 706 s->do_cmd = 0; 707 do_cmd(s); 708 } else { 709 /* 710 * Extra message out bytes received: update cmdfifo_cdb_offset 711 * and then switch to commmand phase 712 */ 713 s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo); 714 s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD; 715 s->rregs[ESP_RSEQ] = SEQ_CD; 716 s->rregs[ESP_RINTR] |= INTR_BS; 717 esp_raise_irq(s); 718 } 719 return; 720 } 721 722 if (!s->current_req) { 723 return; 724 } 725 726 if (s->async_len == 0) { 727 /* Defer until data is available. */ 728 return; 729 } 730 731 if (to_device) { 732 len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ); 733 esp_fifo_pop_buf(&s->fifo, s->async_buf, len); 734 s->async_buf += len; 735 s->async_len -= len; 736 s->ti_size += len; 737 } else { 738 len = MIN(s->ti_size, s->async_len); 739 len = MIN(len, fifo8_num_free(&s->fifo)); 740 fifo8_push_all(&s->fifo, s->async_buf, len); 741 s->async_buf += len; 742 s->async_len -= len; 743 s->ti_size -= len; 744 } 745 746 if (s->async_len == 0) { 747 scsi_req_continue(s->current_req); 748 749 if (to_device || s->ti_size == 0) { 750 return; 751 } 752 } 753 754 s->rregs[ESP_RINTR] |= INTR_BS; 755 esp_raise_irq(s); 756 } 757 758 void esp_command_complete(SCSIRequest *req, size_t resid) 759 { 760 ESPState *s = req->hba_private; 761 762 trace_esp_command_complete(); 763 if (s->ti_size != 0) { 764 trace_esp_command_complete_unexpected(); 765 } 766 s->ti_size = 0; 767 s->async_len = 0; 768 if (req->status) { 769 trace_esp_command_complete_fail(); 770 } 771 s->status = req->status; 772 s->rregs[ESP_RSTAT] = STAT_ST; 773 esp_dma_done(s); 774 esp_lower_drq(s); 775 if (s->current_req) { 776 scsi_req_unref(s->current_req); 777 s->current_req = NULL; 778 s->current_dev = NULL; 779 } 780 } 781 782 void esp_transfer_data(SCSIRequest *req, uint32_t len) 783 { 784 ESPState *s = req->hba_private; 785 int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO); 786 uint32_t dmalen = esp_get_tc(s); 787 788 assert(!s->do_cmd); 789 trace_esp_transfer_data(dmalen, s->ti_size); 790 s->async_len = len; 791 s->async_buf = scsi_req_get_buf(req); 792 793 if (!to_device && !s->data_in_ready) { 794 /* 795 * Initial incoming data xfer is complete so raise command 796 * completion interrupt 797 */ 798 s->data_in_ready = true; 799 s->rregs[ESP_RSTAT] |= STAT_TC; 800 s->rregs[ESP_RINTR] |= INTR_BS; 801 esp_raise_irq(s); 802 803 /* 804 * If data is ready to transfer and the TI command has already 805 * been executed, start DMA immediately. Otherwise DMA will start 806 * when host sends the TI command 807 */ 808 if (s->ti_size && (s->rregs[ESP_CMD] == (CMD_TI | CMD_DMA))) { 809 esp_do_dma(s); 810 } 811 return; 812 } 813 814 if (s->ti_cmd == 0) { 815 /* 816 * Always perform the initial transfer upon reception of the next TI 817 * command to ensure the DMA/non-DMA status of the command is correct. 818 * It is not possible to use s->dma directly in the section below as 819 * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the 820 * async data transfer is delayed then s->dma is set incorrectly. 821 */ 822 return; 823 } 824 825 if (s->ti_cmd & CMD_DMA) { 826 if (dmalen) { 827 esp_do_dma(s); 828 } else if (s->ti_size <= 0) { 829 /* 830 * If this was the last part of a DMA transfer then the 831 * completion interrupt is deferred to here. 832 */ 833 esp_dma_done(s); 834 esp_lower_drq(s); 835 } 836 } else { 837 esp_do_nodma(s); 838 } 839 } 840 841 static void handle_ti(ESPState *s) 842 { 843 uint32_t dmalen; 844 845 if (s->dma && !s->dma_enabled) { 846 s->dma_cb = handle_ti; 847 return; 848 } 849 850 s->ti_cmd = s->rregs[ESP_CMD]; 851 if (s->dma) { 852 dmalen = esp_get_tc(s); 853 trace_esp_handle_ti(dmalen); 854 s->rregs[ESP_RSTAT] &= ~STAT_TC; 855 esp_do_dma(s); 856 } else { 857 trace_esp_handle_ti(s->ti_size); 858 esp_do_nodma(s); 859 } 860 } 861 862 void esp_hard_reset(ESPState *s) 863 { 864 memset(s->rregs, 0, ESP_REGS); 865 memset(s->wregs, 0, ESP_REGS); 866 s->tchi_written = 0; 867 s->ti_size = 0; 868 fifo8_reset(&s->fifo); 869 fifo8_reset(&s->cmdfifo); 870 s->dma = 0; 871 s->do_cmd = 0; 872 s->dma_cb = NULL; 873 874 s->rregs[ESP_CFG1] = 7; 875 } 876 877 static void esp_soft_reset(ESPState *s) 878 { 879 qemu_irq_lower(s->irq); 880 qemu_irq_lower(s->irq_data); 881 esp_hard_reset(s); 882 } 883 884 static void parent_esp_reset(ESPState *s, int irq, int level) 885 { 886 if (level) { 887 esp_soft_reset(s); 888 } 889 } 890 891 uint64_t esp_reg_read(ESPState *s, uint32_t saddr) 892 { 893 uint32_t val; 894 895 switch (saddr) { 896 case ESP_FIFO: 897 if (s->dma_memory_read && s->dma_memory_write && 898 (s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) { 899 /* Data out. */ 900 qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n"); 901 s->rregs[ESP_FIFO] = 0; 902 } else { 903 s->rregs[ESP_FIFO] = esp_fifo_pop(&s->fifo); 904 } 905 val = s->rregs[ESP_FIFO]; 906 break; 907 case ESP_RINTR: 908 /* 909 * Clear sequence step, interrupt register and all status bits 910 * except TC 911 */ 912 val = s->rregs[ESP_RINTR]; 913 s->rregs[ESP_RINTR] = 0; 914 s->rregs[ESP_RSTAT] &= ~STAT_TC; 915 s->rregs[ESP_RSEQ] = SEQ_0; 916 esp_lower_irq(s); 917 break; 918 case ESP_TCHI: 919 /* Return the unique id if the value has never been written */ 920 if (!s->tchi_written) { 921 val = s->chip_id; 922 } else { 923 val = s->rregs[saddr]; 924 } 925 break; 926 case ESP_RFLAGS: 927 /* Bottom 5 bits indicate number of bytes in FIFO */ 928 val = fifo8_num_used(&s->fifo); 929 break; 930 default: 931 val = s->rregs[saddr]; 932 break; 933 } 934 935 trace_esp_mem_readb(saddr, val); 936 return val; 937 } 938 939 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val) 940 { 941 trace_esp_mem_writeb(saddr, s->wregs[saddr], val); 942 switch (saddr) { 943 case ESP_TCHI: 944 s->tchi_written = true; 945 /* fall through */ 946 case ESP_TCLO: 947 case ESP_TCMID: 948 s->rregs[ESP_RSTAT] &= ~STAT_TC; 949 break; 950 case ESP_FIFO: 951 if (s->do_cmd) { 952 esp_fifo_push(&s->cmdfifo, val); 953 } else { 954 esp_fifo_push(&s->fifo, val); 955 } 956 957 /* Non-DMA transfers raise an interrupt after every byte */ 958 if (s->rregs[ESP_CMD] == CMD_TI) { 959 s->rregs[ESP_RINTR] |= INTR_FC | INTR_BS; 960 esp_raise_irq(s); 961 } 962 break; 963 case ESP_CMD: 964 s->rregs[saddr] = val; 965 if (val & CMD_DMA) { 966 s->dma = 1; 967 /* Reload DMA counter. */ 968 if (esp_get_stc(s) == 0) { 969 esp_set_tc(s, 0x10000); 970 } else { 971 esp_set_tc(s, esp_get_stc(s)); 972 } 973 } else { 974 s->dma = 0; 975 } 976 switch (val & CMD_CMD) { 977 case CMD_NOP: 978 trace_esp_mem_writeb_cmd_nop(val); 979 break; 980 case CMD_FLUSH: 981 trace_esp_mem_writeb_cmd_flush(val); 982 fifo8_reset(&s->fifo); 983 break; 984 case CMD_RESET: 985 trace_esp_mem_writeb_cmd_reset(val); 986 esp_soft_reset(s); 987 break; 988 case CMD_BUSRESET: 989 trace_esp_mem_writeb_cmd_bus_reset(val); 990 if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) { 991 s->rregs[ESP_RINTR] |= INTR_RST; 992 esp_raise_irq(s); 993 } 994 break; 995 case CMD_TI: 996 trace_esp_mem_writeb_cmd_ti(val); 997 handle_ti(s); 998 break; 999 case CMD_ICCS: 1000 trace_esp_mem_writeb_cmd_iccs(val); 1001 write_response(s); 1002 s->rregs[ESP_RINTR] |= INTR_FC; 1003 s->rregs[ESP_RSTAT] |= STAT_MI; 1004 break; 1005 case CMD_MSGACC: 1006 trace_esp_mem_writeb_cmd_msgacc(val); 1007 s->rregs[ESP_RINTR] |= INTR_DC; 1008 s->rregs[ESP_RSEQ] = 0; 1009 s->rregs[ESP_RFLAGS] = 0; 1010 esp_raise_irq(s); 1011 break; 1012 case CMD_PAD: 1013 trace_esp_mem_writeb_cmd_pad(val); 1014 s->rregs[ESP_RSTAT] = STAT_TC; 1015 s->rregs[ESP_RINTR] |= INTR_FC; 1016 s->rregs[ESP_RSEQ] = 0; 1017 break; 1018 case CMD_SATN: 1019 trace_esp_mem_writeb_cmd_satn(val); 1020 break; 1021 case CMD_RSTATN: 1022 trace_esp_mem_writeb_cmd_rstatn(val); 1023 break; 1024 case CMD_SEL: 1025 trace_esp_mem_writeb_cmd_sel(val); 1026 handle_s_without_atn(s); 1027 break; 1028 case CMD_SELATN: 1029 trace_esp_mem_writeb_cmd_selatn(val); 1030 handle_satn(s); 1031 break; 1032 case CMD_SELATNS: 1033 trace_esp_mem_writeb_cmd_selatns(val); 1034 handle_satn_stop(s); 1035 break; 1036 case CMD_ENSEL: 1037 trace_esp_mem_writeb_cmd_ensel(val); 1038 s->rregs[ESP_RINTR] = 0; 1039 break; 1040 case CMD_DISSEL: 1041 trace_esp_mem_writeb_cmd_dissel(val); 1042 s->rregs[ESP_RINTR] = 0; 1043 esp_raise_irq(s); 1044 break; 1045 default: 1046 trace_esp_error_unhandled_command(val); 1047 break; 1048 } 1049 break; 1050 case ESP_WBUSID ... ESP_WSYNO: 1051 break; 1052 case ESP_CFG1: 1053 case ESP_CFG2: case ESP_CFG3: 1054 case ESP_RES3: case ESP_RES4: 1055 s->rregs[saddr] = val; 1056 break; 1057 case ESP_WCCF ... ESP_WTEST: 1058 break; 1059 default: 1060 trace_esp_error_invalid_write(val, saddr); 1061 return; 1062 } 1063 s->wregs[saddr] = val; 1064 } 1065 1066 static bool esp_mem_accepts(void *opaque, hwaddr addr, 1067 unsigned size, bool is_write, 1068 MemTxAttrs attrs) 1069 { 1070 return (size == 1) || (is_write && size == 4); 1071 } 1072 1073 static bool esp_is_before_version_5(void *opaque, int version_id) 1074 { 1075 ESPState *s = ESP(opaque); 1076 1077 version_id = MIN(version_id, s->mig_version_id); 1078 return version_id < 5; 1079 } 1080 1081 static bool esp_is_version_5(void *opaque, int version_id) 1082 { 1083 ESPState *s = ESP(opaque); 1084 1085 version_id = MIN(version_id, s->mig_version_id); 1086 return version_id == 5; 1087 } 1088 1089 int esp_pre_save(void *opaque) 1090 { 1091 ESPState *s = ESP(object_resolve_path_component( 1092 OBJECT(opaque), "esp")); 1093 1094 s->mig_version_id = vmstate_esp.version_id; 1095 return 0; 1096 } 1097 1098 static int esp_post_load(void *opaque, int version_id) 1099 { 1100 ESPState *s = ESP(opaque); 1101 int len, i; 1102 1103 version_id = MIN(version_id, s->mig_version_id); 1104 1105 if (version_id < 5) { 1106 esp_set_tc(s, s->mig_dma_left); 1107 1108 /* Migrate ti_buf to fifo */ 1109 len = s->mig_ti_wptr - s->mig_ti_rptr; 1110 for (i = 0; i < len; i++) { 1111 fifo8_push(&s->fifo, s->mig_ti_buf[i]); 1112 } 1113 1114 /* Migrate cmdbuf to cmdfifo */ 1115 for (i = 0; i < s->mig_cmdlen; i++) { 1116 fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]); 1117 } 1118 } 1119 1120 s->mig_version_id = vmstate_esp.version_id; 1121 return 0; 1122 } 1123 1124 const VMStateDescription vmstate_esp = { 1125 .name = "esp", 1126 .version_id = 5, 1127 .minimum_version_id = 3, 1128 .post_load = esp_post_load, 1129 .fields = (VMStateField[]) { 1130 VMSTATE_BUFFER(rregs, ESPState), 1131 VMSTATE_BUFFER(wregs, ESPState), 1132 VMSTATE_INT32(ti_size, ESPState), 1133 VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5), 1134 VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5), 1135 VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5), 1136 VMSTATE_UINT32(status, ESPState), 1137 VMSTATE_UINT32_TEST(mig_deferred_status, ESPState, 1138 esp_is_before_version_5), 1139 VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState, 1140 esp_is_before_version_5), 1141 VMSTATE_UINT32(dma, ESPState), 1142 VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0, 1143 esp_is_before_version_5, 0, 16), 1144 VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4, 1145 esp_is_before_version_5, 16, 1146 sizeof(typeof_field(ESPState, mig_cmdbuf))), 1147 VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5), 1148 VMSTATE_UINT32(do_cmd, ESPState), 1149 VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5), 1150 VMSTATE_BOOL_TEST(data_in_ready, ESPState, esp_is_version_5), 1151 VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5), 1152 VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5), 1153 VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5), 1154 VMSTATE_UINT8_TEST(ti_cmd, ESPState, esp_is_version_5), 1155 VMSTATE_END_OF_LIST() 1156 }, 1157 }; 1158 1159 static void sysbus_esp_mem_write(void *opaque, hwaddr addr, 1160 uint64_t val, unsigned int size) 1161 { 1162 SysBusESPState *sysbus = opaque; 1163 ESPState *s = ESP(&sysbus->esp); 1164 uint32_t saddr; 1165 1166 saddr = addr >> sysbus->it_shift; 1167 esp_reg_write(s, saddr, val); 1168 } 1169 1170 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr, 1171 unsigned int size) 1172 { 1173 SysBusESPState *sysbus = opaque; 1174 ESPState *s = ESP(&sysbus->esp); 1175 uint32_t saddr; 1176 1177 saddr = addr >> sysbus->it_shift; 1178 return esp_reg_read(s, saddr); 1179 } 1180 1181 static const MemoryRegionOps sysbus_esp_mem_ops = { 1182 .read = sysbus_esp_mem_read, 1183 .write = sysbus_esp_mem_write, 1184 .endianness = DEVICE_NATIVE_ENDIAN, 1185 .valid.accepts = esp_mem_accepts, 1186 }; 1187 1188 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr, 1189 uint64_t val, unsigned int size) 1190 { 1191 SysBusESPState *sysbus = opaque; 1192 ESPState *s = ESP(&sysbus->esp); 1193 uint32_t dmalen; 1194 1195 trace_esp_pdma_write(size); 1196 1197 switch (size) { 1198 case 1: 1199 esp_pdma_write(s, val); 1200 break; 1201 case 2: 1202 esp_pdma_write(s, val >> 8); 1203 esp_pdma_write(s, val); 1204 break; 1205 } 1206 dmalen = esp_get_tc(s); 1207 if (dmalen == 0 || fifo8_num_free(&s->fifo) < 2) { 1208 s->pdma_cb(s); 1209 } 1210 } 1211 1212 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr, 1213 unsigned int size) 1214 { 1215 SysBusESPState *sysbus = opaque; 1216 ESPState *s = ESP(&sysbus->esp); 1217 uint64_t val = 0; 1218 1219 trace_esp_pdma_read(size); 1220 1221 switch (size) { 1222 case 1: 1223 val = esp_pdma_read(s); 1224 break; 1225 case 2: 1226 val = esp_pdma_read(s); 1227 val = (val << 8) | esp_pdma_read(s); 1228 break; 1229 } 1230 if (fifo8_num_used(&s->fifo) < 2) { 1231 s->pdma_cb(s); 1232 } 1233 return val; 1234 } 1235 1236 static const MemoryRegionOps sysbus_esp_pdma_ops = { 1237 .read = sysbus_esp_pdma_read, 1238 .write = sysbus_esp_pdma_write, 1239 .endianness = DEVICE_NATIVE_ENDIAN, 1240 .valid.min_access_size = 1, 1241 .valid.max_access_size = 4, 1242 .impl.min_access_size = 1, 1243 .impl.max_access_size = 2, 1244 }; 1245 1246 static const struct SCSIBusInfo esp_scsi_info = { 1247 .tcq = false, 1248 .max_target = ESP_MAX_DEVS, 1249 .max_lun = 7, 1250 1251 .transfer_data = esp_transfer_data, 1252 .complete = esp_command_complete, 1253 .cancel = esp_request_cancelled 1254 }; 1255 1256 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level) 1257 { 1258 SysBusESPState *sysbus = SYSBUS_ESP(opaque); 1259 ESPState *s = ESP(&sysbus->esp); 1260 1261 switch (irq) { 1262 case 0: 1263 parent_esp_reset(s, irq, level); 1264 break; 1265 case 1: 1266 esp_dma_enable(opaque, irq, level); 1267 break; 1268 } 1269 } 1270 1271 static void sysbus_esp_realize(DeviceState *dev, Error **errp) 1272 { 1273 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 1274 SysBusESPState *sysbus = SYSBUS_ESP(dev); 1275 ESPState *s = ESP(&sysbus->esp); 1276 1277 if (!qdev_realize(DEVICE(s), NULL, errp)) { 1278 return; 1279 } 1280 1281 sysbus_init_irq(sbd, &s->irq); 1282 sysbus_init_irq(sbd, &s->irq_data); 1283 assert(sysbus->it_shift != -1); 1284 1285 s->chip_id = TCHI_FAS100A; 1286 memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops, 1287 sysbus, "esp-regs", ESP_REGS << sysbus->it_shift); 1288 sysbus_init_mmio(sbd, &sysbus->iomem); 1289 memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops, 1290 sysbus, "esp-pdma", 4); 1291 sysbus_init_mmio(sbd, &sysbus->pdma); 1292 1293 qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2); 1294 1295 scsi_bus_new(&s->bus, sizeof(s->bus), dev, &esp_scsi_info, NULL); 1296 } 1297 1298 static void sysbus_esp_hard_reset(DeviceState *dev) 1299 { 1300 SysBusESPState *sysbus = SYSBUS_ESP(dev); 1301 ESPState *s = ESP(&sysbus->esp); 1302 1303 esp_hard_reset(s); 1304 } 1305 1306 static void sysbus_esp_init(Object *obj) 1307 { 1308 SysBusESPState *sysbus = SYSBUS_ESP(obj); 1309 1310 object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP); 1311 } 1312 1313 static const VMStateDescription vmstate_sysbus_esp_scsi = { 1314 .name = "sysbusespscsi", 1315 .version_id = 2, 1316 .minimum_version_id = 1, 1317 .pre_save = esp_pre_save, 1318 .fields = (VMStateField[]) { 1319 VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2), 1320 VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState), 1321 VMSTATE_END_OF_LIST() 1322 } 1323 }; 1324 1325 static void sysbus_esp_class_init(ObjectClass *klass, void *data) 1326 { 1327 DeviceClass *dc = DEVICE_CLASS(klass); 1328 1329 dc->realize = sysbus_esp_realize; 1330 dc->reset = sysbus_esp_hard_reset; 1331 dc->vmsd = &vmstate_sysbus_esp_scsi; 1332 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 1333 } 1334 1335 static const TypeInfo sysbus_esp_info = { 1336 .name = TYPE_SYSBUS_ESP, 1337 .parent = TYPE_SYS_BUS_DEVICE, 1338 .instance_init = sysbus_esp_init, 1339 .instance_size = sizeof(SysBusESPState), 1340 .class_init = sysbus_esp_class_init, 1341 }; 1342 1343 static void esp_finalize(Object *obj) 1344 { 1345 ESPState *s = ESP(obj); 1346 1347 fifo8_destroy(&s->fifo); 1348 fifo8_destroy(&s->cmdfifo); 1349 } 1350 1351 static void esp_init(Object *obj) 1352 { 1353 ESPState *s = ESP(obj); 1354 1355 fifo8_create(&s->fifo, ESP_FIFO_SZ); 1356 fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ); 1357 } 1358 1359 static void esp_class_init(ObjectClass *klass, void *data) 1360 { 1361 DeviceClass *dc = DEVICE_CLASS(klass); 1362 1363 /* internal device for sysbusesp/pciespscsi, not user-creatable */ 1364 dc->user_creatable = false; 1365 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 1366 } 1367 1368 static const TypeInfo esp_info = { 1369 .name = TYPE_ESP, 1370 .parent = TYPE_DEVICE, 1371 .instance_init = esp_init, 1372 .instance_finalize = esp_finalize, 1373 .instance_size = sizeof(ESPState), 1374 .class_init = esp_class_init, 1375 }; 1376 1377 static void esp_register_types(void) 1378 { 1379 type_register_static(&sysbus_esp_info); 1380 type_register_static(&esp_info); 1381 } 1382 1383 type_init(esp_register_types) 1384