1 /* 2 * QEMU ESP/NCR53C9x emulation 3 * 4 * Copyright (c) 2005-2006 Fabrice Bellard 5 * Copyright (c) 2012 Herve Poussineau 6 * Copyright (c) 2023 Mark Cave-Ayland 7 * 8 * Permission is hereby granted, free of charge, to any person obtaining a copy 9 * of this software and associated documentation files (the "Software"), to deal 10 * in the Software without restriction, including without limitation the rights 11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 * copies of the Software, and to permit persons to whom the Software is 13 * furnished to do so, subject to the following conditions: 14 * 15 * The above copyright notice and this permission notice shall be included in 16 * all copies or substantial portions of the Software. 17 * 18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 24 * THE SOFTWARE. 25 */ 26 27 #include "qemu/osdep.h" 28 #include "hw/sysbus.h" 29 #include "migration/vmstate.h" 30 #include "hw/irq.h" 31 #include "hw/scsi/esp.h" 32 #include "trace.h" 33 #include "qemu/log.h" 34 #include "qemu/module.h" 35 36 /* 37 * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O), 38 * also produced as NCR89C100. See 39 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt 40 * and 41 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt 42 * 43 * On Macintosh Quadra it is a NCR53C96. 44 */ 45 46 static void esp_raise_irq(ESPState *s) 47 { 48 if (!(s->rregs[ESP_RSTAT] & STAT_INT)) { 49 s->rregs[ESP_RSTAT] |= STAT_INT; 50 qemu_irq_raise(s->irq); 51 trace_esp_raise_irq(); 52 } 53 } 54 55 static void esp_lower_irq(ESPState *s) 56 { 57 if (s->rregs[ESP_RSTAT] & STAT_INT) { 58 s->rregs[ESP_RSTAT] &= ~STAT_INT; 59 qemu_irq_lower(s->irq); 60 trace_esp_lower_irq(); 61 } 62 } 63 64 static void esp_raise_drq(ESPState *s) 65 { 66 if (!(s->drq_state)) { 67 qemu_irq_raise(s->drq_irq); 68 trace_esp_raise_drq(); 69 s->drq_state = true; 70 } 71 } 72 73 static void esp_lower_drq(ESPState *s) 74 { 75 if (s->drq_state) { 76 qemu_irq_lower(s->drq_irq); 77 trace_esp_lower_drq(); 78 s->drq_state = false; 79 } 80 } 81 82 static const char *esp_phase_names[8] = { 83 "DATA OUT", "DATA IN", "COMMAND", "STATUS", 84 "(reserved)", "(reserved)", "MESSAGE OUT", "MESSAGE IN" 85 }; 86 87 static void esp_set_phase(ESPState *s, uint8_t phase) 88 { 89 s->rregs[ESP_RSTAT] &= ~7; 90 s->rregs[ESP_RSTAT] |= phase; 91 92 trace_esp_set_phase(esp_phase_names[phase]); 93 } 94 95 static uint8_t esp_get_phase(ESPState *s) 96 { 97 return s->rregs[ESP_RSTAT] & 7; 98 } 99 100 void esp_dma_enable(ESPState *s, int irq, int level) 101 { 102 if (level) { 103 s->dma_enabled = 1; 104 trace_esp_dma_enable(); 105 if (s->dma_cb) { 106 s->dma_cb(s); 107 s->dma_cb = NULL; 108 } 109 } else { 110 trace_esp_dma_disable(); 111 s->dma_enabled = 0; 112 } 113 } 114 115 void esp_request_cancelled(SCSIRequest *req) 116 { 117 ESPState *s = req->hba_private; 118 119 if (req == s->current_req) { 120 scsi_req_unref(s->current_req); 121 s->current_req = NULL; 122 s->current_dev = NULL; 123 s->async_len = 0; 124 } 125 } 126 127 static void esp_update_drq(ESPState *s) 128 { 129 bool to_device; 130 131 switch (esp_get_phase(s)) { 132 case STAT_MO: 133 case STAT_CD: 134 case STAT_DO: 135 to_device = true; 136 break; 137 138 case STAT_DI: 139 case STAT_ST: 140 case STAT_MI: 141 to_device = false; 142 break; 143 144 default: 145 return; 146 } 147 148 if (s->dma) { 149 /* DMA request so update DRQ according to transfer direction */ 150 if (to_device) { 151 if (fifo8_num_free(&s->fifo) < 2) { 152 esp_lower_drq(s); 153 } else { 154 esp_raise_drq(s); 155 } 156 } else { 157 if (fifo8_num_used(&s->fifo) < 2) { 158 esp_lower_drq(s); 159 } else { 160 esp_raise_drq(s); 161 } 162 } 163 } else { 164 /* Not a DMA request */ 165 esp_lower_drq(s); 166 } 167 } 168 169 static void esp_fifo_push(ESPState *s, uint8_t val) 170 { 171 if (fifo8_num_used(&s->fifo) == s->fifo.capacity) { 172 trace_esp_error_fifo_overrun(); 173 } else { 174 fifo8_push(&s->fifo, val); 175 } 176 177 esp_update_drq(s); 178 } 179 180 static void esp_fifo_push_buf(ESPState *s, uint8_t *buf, int len) 181 { 182 fifo8_push_all(&s->fifo, buf, len); 183 esp_update_drq(s); 184 } 185 186 static uint8_t esp_fifo_pop(ESPState *s) 187 { 188 uint8_t val; 189 190 if (fifo8_is_empty(&s->fifo)) { 191 val = 0; 192 } else { 193 val = fifo8_pop(&s->fifo); 194 } 195 196 esp_update_drq(s); 197 return val; 198 } 199 200 static uint32_t esp_fifo_pop_buf(ESPState *s, uint8_t *dest, int maxlen) 201 { 202 uint32_t len = fifo8_pop_buf(&s->fifo, dest, maxlen); 203 204 esp_update_drq(s); 205 return len; 206 } 207 208 static uint32_t esp_get_tc(ESPState *s) 209 { 210 uint32_t dmalen; 211 212 dmalen = s->rregs[ESP_TCLO]; 213 dmalen |= s->rregs[ESP_TCMID] << 8; 214 dmalen |= s->rregs[ESP_TCHI] << 16; 215 216 return dmalen; 217 } 218 219 static void esp_set_tc(ESPState *s, uint32_t dmalen) 220 { 221 uint32_t old_tc = esp_get_tc(s); 222 223 s->rregs[ESP_TCLO] = dmalen; 224 s->rregs[ESP_TCMID] = dmalen >> 8; 225 s->rregs[ESP_TCHI] = dmalen >> 16; 226 227 if (old_tc && dmalen == 0) { 228 s->rregs[ESP_RSTAT] |= STAT_TC; 229 } 230 } 231 232 static uint32_t esp_get_stc(ESPState *s) 233 { 234 uint32_t dmalen; 235 236 dmalen = s->wregs[ESP_TCLO]; 237 dmalen |= s->wregs[ESP_TCMID] << 8; 238 dmalen |= s->wregs[ESP_TCHI] << 16; 239 240 return dmalen; 241 } 242 243 static uint8_t esp_pdma_read(ESPState *s) 244 { 245 uint8_t val; 246 247 val = esp_fifo_pop(s); 248 return val; 249 } 250 251 static void esp_pdma_write(ESPState *s, uint8_t val) 252 { 253 uint32_t dmalen = esp_get_tc(s); 254 255 esp_fifo_push(s, val); 256 257 if (dmalen && s->drq_state) { 258 dmalen--; 259 esp_set_tc(s, dmalen); 260 } 261 } 262 263 static int esp_select(ESPState *s) 264 { 265 int target; 266 267 target = s->wregs[ESP_WBUSID] & BUSID_DID; 268 269 s->ti_size = 0; 270 s->rregs[ESP_RSEQ] = SEQ_0; 271 272 if (s->current_req) { 273 /* Started a new command before the old one finished. Cancel it. */ 274 scsi_req_cancel(s->current_req); 275 } 276 277 s->current_dev = scsi_device_find(&s->bus, 0, target, 0); 278 if (!s->current_dev) { 279 /* No such drive */ 280 s->rregs[ESP_RSTAT] = 0; 281 s->rregs[ESP_RINTR] = INTR_DC; 282 esp_raise_irq(s); 283 return -1; 284 } 285 286 /* 287 * Note that we deliberately don't raise the IRQ here: this will be done 288 * either in esp_transfer_data() or esp_command_complete() 289 */ 290 return 0; 291 } 292 293 static void esp_do_dma(ESPState *s); 294 static void esp_do_nodma(ESPState *s); 295 296 static void do_command_phase(ESPState *s) 297 { 298 uint32_t cmdlen; 299 int32_t datalen; 300 SCSIDevice *current_lun; 301 uint8_t buf[ESP_CMDFIFO_SZ]; 302 303 trace_esp_do_command_phase(s->lun); 304 cmdlen = fifo8_num_used(&s->cmdfifo); 305 if (!cmdlen || !s->current_dev) { 306 return; 307 } 308 fifo8_pop_buf(&s->cmdfifo, buf, cmdlen); 309 310 current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun); 311 if (!current_lun) { 312 /* No such drive */ 313 s->rregs[ESP_RSTAT] = 0; 314 s->rregs[ESP_RINTR] = INTR_DC; 315 s->rregs[ESP_RSEQ] = SEQ_0; 316 esp_raise_irq(s); 317 return; 318 } 319 320 s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s); 321 datalen = scsi_req_enqueue(s->current_req); 322 s->ti_size = datalen; 323 fifo8_reset(&s->cmdfifo); 324 s->data_ready = false; 325 if (datalen != 0) { 326 /* 327 * Switch to DATA phase but wait until initial data xfer is 328 * complete before raising the command completion interrupt 329 */ 330 if (datalen > 0) { 331 esp_set_phase(s, STAT_DI); 332 } else { 333 esp_set_phase(s, STAT_DO); 334 } 335 scsi_req_continue(s->current_req); 336 return; 337 } 338 } 339 340 static void do_message_phase(ESPState *s) 341 { 342 if (s->cmdfifo_cdb_offset) { 343 uint8_t message = fifo8_is_empty(&s->cmdfifo) ? 0 : 344 fifo8_pop(&s->cmdfifo); 345 346 trace_esp_do_identify(message); 347 s->lun = message & 7; 348 s->cmdfifo_cdb_offset--; 349 } 350 351 /* Ignore extended messages for now */ 352 if (s->cmdfifo_cdb_offset) { 353 int len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo)); 354 fifo8_drop(&s->cmdfifo, len); 355 s->cmdfifo_cdb_offset = 0; 356 } 357 } 358 359 static void do_cmd(ESPState *s) 360 { 361 do_message_phase(s); 362 assert(s->cmdfifo_cdb_offset == 0); 363 do_command_phase(s); 364 } 365 366 static void handle_satn(ESPState *s) 367 { 368 if (s->dma && !s->dma_enabled) { 369 s->dma_cb = handle_satn; 370 return; 371 } 372 373 if (esp_select(s) < 0) { 374 return; 375 } 376 377 esp_set_phase(s, STAT_MO); 378 379 if (s->dma) { 380 esp_do_dma(s); 381 } else { 382 esp_do_nodma(s); 383 } 384 } 385 386 static void handle_s_without_atn(ESPState *s) 387 { 388 if (s->dma && !s->dma_enabled) { 389 s->dma_cb = handle_s_without_atn; 390 return; 391 } 392 393 if (esp_select(s) < 0) { 394 return; 395 } 396 397 esp_set_phase(s, STAT_CD); 398 s->cmdfifo_cdb_offset = 0; 399 400 if (s->dma) { 401 esp_do_dma(s); 402 } else { 403 esp_do_nodma(s); 404 } 405 } 406 407 static void handle_satn_stop(ESPState *s) 408 { 409 if (s->dma && !s->dma_enabled) { 410 s->dma_cb = handle_satn_stop; 411 return; 412 } 413 414 if (esp_select(s) < 0) { 415 return; 416 } 417 418 esp_set_phase(s, STAT_MO); 419 s->cmdfifo_cdb_offset = 0; 420 421 if (s->dma) { 422 esp_do_dma(s); 423 } else { 424 esp_do_nodma(s); 425 } 426 } 427 428 static void handle_pad(ESPState *s) 429 { 430 if (s->dma) { 431 esp_do_dma(s); 432 } else { 433 esp_do_nodma(s); 434 } 435 } 436 437 static void write_response(ESPState *s) 438 { 439 trace_esp_write_response(s->status); 440 441 if (s->dma) { 442 esp_do_dma(s); 443 } else { 444 esp_do_nodma(s); 445 } 446 } 447 448 static bool esp_cdb_ready(ESPState *s) 449 { 450 int len = fifo8_num_used(&s->cmdfifo) - s->cmdfifo_cdb_offset; 451 const uint8_t *pbuf; 452 uint32_t n; 453 int cdblen; 454 455 if (len <= 0) { 456 return false; 457 } 458 459 pbuf = fifo8_peek_bufptr(&s->cmdfifo, len, &n); 460 if (n < len) { 461 /* 462 * In normal use the cmdfifo should never wrap, but include this check 463 * to prevent a malicious guest from reading past the end of the 464 * cmdfifo data buffer below 465 */ 466 return false; 467 } 468 469 cdblen = scsi_cdb_length((uint8_t *)&pbuf[s->cmdfifo_cdb_offset]); 470 471 return cdblen < 0 ? false : (len >= cdblen); 472 } 473 474 static void esp_dma_ti_check(ESPState *s) 475 { 476 if (esp_get_tc(s) == 0 && fifo8_num_used(&s->fifo) < 2) { 477 s->rregs[ESP_RINTR] |= INTR_BS; 478 esp_raise_irq(s); 479 } 480 } 481 482 static void esp_do_dma(ESPState *s) 483 { 484 uint32_t len, cmdlen; 485 uint8_t buf[ESP_CMDFIFO_SZ]; 486 487 len = esp_get_tc(s); 488 489 switch (esp_get_phase(s)) { 490 case STAT_MO: 491 if (s->dma_memory_read) { 492 len = MIN(len, fifo8_num_free(&s->cmdfifo)); 493 s->dma_memory_read(s->dma_opaque, buf, len); 494 esp_set_tc(s, esp_get_tc(s) - len); 495 } else { 496 len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo)); 497 len = MIN(fifo8_num_free(&s->cmdfifo), len); 498 } 499 500 fifo8_push_all(&s->cmdfifo, buf, len); 501 s->cmdfifo_cdb_offset += len; 502 503 switch (s->rregs[ESP_CMD]) { 504 case CMD_SELATN | CMD_DMA: 505 if (fifo8_num_used(&s->cmdfifo) >= 1) { 506 /* First byte received, switch to command phase */ 507 esp_set_phase(s, STAT_CD); 508 s->rregs[ESP_RSEQ] = SEQ_CD; 509 s->cmdfifo_cdb_offset = 1; 510 511 if (fifo8_num_used(&s->cmdfifo) > 1) { 512 /* Process any additional command phase data */ 513 esp_do_dma(s); 514 } 515 } 516 break; 517 518 case CMD_SELATNS | CMD_DMA: 519 if (fifo8_num_used(&s->cmdfifo) == 1) { 520 /* First byte received, stop in message out phase */ 521 s->rregs[ESP_RSEQ] = SEQ_MO; 522 s->cmdfifo_cdb_offset = 1; 523 524 /* Raise command completion interrupt */ 525 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC; 526 esp_raise_irq(s); 527 } 528 break; 529 530 case CMD_TI | CMD_DMA: 531 /* ATN remains asserted until TC == 0 */ 532 if (esp_get_tc(s) == 0) { 533 esp_set_phase(s, STAT_CD); 534 s->rregs[ESP_CMD] = 0; 535 s->rregs[ESP_RINTR] |= INTR_BS; 536 esp_raise_irq(s); 537 } 538 break; 539 } 540 break; 541 542 case STAT_CD: 543 cmdlen = fifo8_num_used(&s->cmdfifo); 544 trace_esp_do_dma(cmdlen, len); 545 if (s->dma_memory_read) { 546 len = MIN(len, fifo8_num_free(&s->cmdfifo)); 547 s->dma_memory_read(s->dma_opaque, buf, len); 548 fifo8_push_all(&s->cmdfifo, buf, len); 549 esp_set_tc(s, esp_get_tc(s) - len); 550 } else { 551 len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo)); 552 len = MIN(fifo8_num_free(&s->cmdfifo), len); 553 fifo8_push_all(&s->cmdfifo, buf, len); 554 } 555 trace_esp_handle_ti_cmd(cmdlen); 556 s->ti_size = 0; 557 if (esp_get_tc(s) == 0) { 558 /* Command has been received */ 559 do_cmd(s); 560 } 561 break; 562 563 case STAT_DO: 564 if (!s->current_req) { 565 return; 566 } 567 if (s->async_len == 0 && esp_get_tc(s)) { 568 /* Defer until data is available. */ 569 return; 570 } 571 if (len > s->async_len) { 572 len = s->async_len; 573 } 574 575 switch (s->rregs[ESP_CMD]) { 576 case CMD_TI | CMD_DMA: 577 if (s->dma_memory_read) { 578 s->dma_memory_read(s->dma_opaque, s->async_buf, len); 579 esp_set_tc(s, esp_get_tc(s) - len); 580 } else { 581 /* Copy FIFO data to device */ 582 len = MIN(s->async_len, ESP_FIFO_SZ); 583 len = MIN(len, fifo8_num_used(&s->fifo)); 584 len = esp_fifo_pop_buf(s, s->async_buf, len); 585 } 586 587 s->async_buf += len; 588 s->async_len -= len; 589 s->ti_size += len; 590 break; 591 592 case CMD_PAD | CMD_DMA: 593 /* Copy TC zero bytes into the incoming stream */ 594 if (!s->dma_memory_read) { 595 len = MIN(s->async_len, ESP_FIFO_SZ); 596 len = MIN(len, fifo8_num_free(&s->fifo)); 597 } 598 599 memset(s->async_buf, 0, len); 600 601 s->async_buf += len; 602 s->async_len -= len; 603 s->ti_size += len; 604 break; 605 } 606 607 if (s->async_len == 0 && fifo8_num_used(&s->fifo) < 2) { 608 /* Defer until the scsi layer has completed */ 609 scsi_req_continue(s->current_req); 610 return; 611 } 612 613 esp_dma_ti_check(s); 614 break; 615 616 case STAT_DI: 617 if (!s->current_req) { 618 return; 619 } 620 if (s->async_len == 0 && esp_get_tc(s)) { 621 /* Defer until data is available. */ 622 return; 623 } 624 if (len > s->async_len) { 625 len = s->async_len; 626 } 627 628 switch (s->rregs[ESP_CMD]) { 629 case CMD_TI | CMD_DMA: 630 if (s->dma_memory_write) { 631 s->dma_memory_write(s->dma_opaque, s->async_buf, len); 632 } else { 633 /* Copy device data to FIFO */ 634 len = MIN(len, fifo8_num_free(&s->fifo)); 635 esp_fifo_push_buf(s, s->async_buf, len); 636 } 637 638 s->async_buf += len; 639 s->async_len -= len; 640 s->ti_size -= len; 641 esp_set_tc(s, esp_get_tc(s) - len); 642 break; 643 644 case CMD_PAD | CMD_DMA: 645 /* Drop TC bytes from the incoming stream */ 646 if (!s->dma_memory_write) { 647 len = MIN(len, fifo8_num_free(&s->fifo)); 648 } 649 650 s->async_buf += len; 651 s->async_len -= len; 652 s->ti_size -= len; 653 esp_set_tc(s, esp_get_tc(s) - len); 654 break; 655 } 656 657 if (s->async_len == 0 && s->ti_size == 0 && esp_get_tc(s)) { 658 /* If the guest underflows TC then terminate SCSI request */ 659 scsi_req_continue(s->current_req); 660 return; 661 } 662 663 if (s->async_len == 0 && fifo8_num_used(&s->fifo) < 2) { 664 /* Defer until the scsi layer has completed */ 665 scsi_req_continue(s->current_req); 666 return; 667 } 668 669 esp_dma_ti_check(s); 670 break; 671 672 case STAT_ST: 673 switch (s->rregs[ESP_CMD]) { 674 case CMD_ICCS | CMD_DMA: 675 len = MIN(len, 1); 676 677 if (len) { 678 buf[0] = s->status; 679 680 if (s->dma_memory_write) { 681 s->dma_memory_write(s->dma_opaque, buf, len); 682 } else { 683 esp_fifo_push_buf(s, buf, len); 684 } 685 686 esp_set_tc(s, esp_get_tc(s) - len); 687 esp_set_phase(s, STAT_MI); 688 689 if (esp_get_tc(s) > 0) { 690 /* Process any message in phase data */ 691 esp_do_dma(s); 692 } 693 } 694 break; 695 696 default: 697 /* Consume remaining data if the guest underflows TC */ 698 if (fifo8_num_used(&s->fifo) < 2) { 699 s->rregs[ESP_RINTR] |= INTR_BS; 700 esp_raise_irq(s); 701 } 702 break; 703 } 704 break; 705 706 case STAT_MI: 707 switch (s->rregs[ESP_CMD]) { 708 case CMD_ICCS | CMD_DMA: 709 len = MIN(len, 1); 710 711 if (len) { 712 buf[0] = 0; 713 714 if (s->dma_memory_write) { 715 s->dma_memory_write(s->dma_opaque, buf, len); 716 } else { 717 esp_fifo_push_buf(s, buf, len); 718 } 719 720 esp_set_tc(s, esp_get_tc(s) - len); 721 722 /* Raise end of command interrupt */ 723 s->rregs[ESP_RINTR] |= INTR_FC; 724 esp_raise_irq(s); 725 } 726 break; 727 } 728 break; 729 } 730 } 731 732 static void esp_nodma_ti_dataout(ESPState *s) 733 { 734 int len; 735 736 if (!s->current_req) { 737 return; 738 } 739 if (s->async_len == 0) { 740 /* Defer until data is available. */ 741 return; 742 } 743 len = MIN(s->async_len, ESP_FIFO_SZ); 744 len = MIN(len, fifo8_num_used(&s->fifo)); 745 esp_fifo_pop_buf(s, s->async_buf, len); 746 s->async_buf += len; 747 s->async_len -= len; 748 s->ti_size += len; 749 750 if (s->async_len == 0) { 751 scsi_req_continue(s->current_req); 752 return; 753 } 754 755 s->rregs[ESP_RINTR] |= INTR_BS; 756 esp_raise_irq(s); 757 } 758 759 static void esp_do_nodma(ESPState *s) 760 { 761 uint8_t buf[ESP_FIFO_SZ]; 762 uint32_t cmdlen; 763 int len; 764 765 switch (esp_get_phase(s)) { 766 case STAT_MO: 767 switch (s->rregs[ESP_CMD]) { 768 case CMD_SELATN: 769 /* Copy FIFO into cmdfifo */ 770 len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo)); 771 len = MIN(fifo8_num_free(&s->cmdfifo), len); 772 fifo8_push_all(&s->cmdfifo, buf, len); 773 774 if (fifo8_num_used(&s->cmdfifo) >= 1) { 775 /* First byte received, switch to command phase */ 776 esp_set_phase(s, STAT_CD); 777 s->rregs[ESP_RSEQ] = SEQ_CD; 778 s->cmdfifo_cdb_offset = 1; 779 780 if (fifo8_num_used(&s->cmdfifo) > 1) { 781 /* Process any additional command phase data */ 782 esp_do_nodma(s); 783 } 784 } 785 break; 786 787 case CMD_SELATNS: 788 /* Copy one byte from FIFO into cmdfifo */ 789 len = esp_fifo_pop_buf(s, buf, 790 MIN(fifo8_num_used(&s->fifo), 1)); 791 len = MIN(fifo8_num_free(&s->cmdfifo), len); 792 fifo8_push_all(&s->cmdfifo, buf, len); 793 794 if (fifo8_num_used(&s->cmdfifo) >= 1) { 795 /* First byte received, stop in message out phase */ 796 s->rregs[ESP_RSEQ] = SEQ_MO; 797 s->cmdfifo_cdb_offset = 1; 798 799 /* Raise command completion interrupt */ 800 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC; 801 esp_raise_irq(s); 802 } 803 break; 804 805 case CMD_TI: 806 /* Copy FIFO into cmdfifo */ 807 len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo)); 808 len = MIN(fifo8_num_free(&s->cmdfifo), len); 809 fifo8_push_all(&s->cmdfifo, buf, len); 810 811 /* ATN remains asserted until FIFO empty */ 812 s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo); 813 esp_set_phase(s, STAT_CD); 814 s->rregs[ESP_CMD] = 0; 815 s->rregs[ESP_RINTR] |= INTR_BS; 816 esp_raise_irq(s); 817 break; 818 } 819 break; 820 821 case STAT_CD: 822 switch (s->rregs[ESP_CMD]) { 823 case CMD_TI: 824 /* Copy FIFO into cmdfifo */ 825 len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo)); 826 len = MIN(fifo8_num_free(&s->cmdfifo), len); 827 fifo8_push_all(&s->cmdfifo, buf, len); 828 829 cmdlen = fifo8_num_used(&s->cmdfifo); 830 trace_esp_handle_ti_cmd(cmdlen); 831 832 /* CDB may be transferred in one or more TI commands */ 833 if (esp_cdb_ready(s)) { 834 /* Command has been received */ 835 do_cmd(s); 836 } else { 837 /* 838 * If data was transferred from the FIFO then raise bus 839 * service interrupt to indicate transfer complete. Otherwise 840 * defer until the next FIFO write. 841 */ 842 if (len) { 843 /* Raise interrupt to indicate transfer complete */ 844 s->rregs[ESP_RINTR] |= INTR_BS; 845 esp_raise_irq(s); 846 } 847 } 848 break; 849 850 case CMD_SEL | CMD_DMA: 851 case CMD_SELATN | CMD_DMA: 852 /* Copy FIFO into cmdfifo */ 853 len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo)); 854 len = MIN(fifo8_num_free(&s->cmdfifo), len); 855 fifo8_push_all(&s->cmdfifo, buf, len); 856 857 /* Handle when DMA transfer is terminated by non-DMA FIFO write */ 858 if (esp_cdb_ready(s)) { 859 /* Command has been received */ 860 do_cmd(s); 861 } 862 break; 863 864 case CMD_SEL: 865 case CMD_SELATN: 866 /* FIFO already contain entire CDB: copy to cmdfifo and execute */ 867 len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo)); 868 len = MIN(fifo8_num_free(&s->cmdfifo), len); 869 fifo8_push_all(&s->cmdfifo, buf, len); 870 871 do_cmd(s); 872 break; 873 } 874 break; 875 876 case STAT_DO: 877 /* Accumulate data in FIFO until non-DMA TI is executed */ 878 break; 879 880 case STAT_DI: 881 if (!s->current_req) { 882 return; 883 } 884 if (s->async_len == 0) { 885 /* Defer until data is available. */ 886 return; 887 } 888 if (fifo8_is_empty(&s->fifo)) { 889 esp_fifo_push(s, s->async_buf[0]); 890 s->async_buf++; 891 s->async_len--; 892 s->ti_size--; 893 } 894 895 if (s->async_len == 0) { 896 scsi_req_continue(s->current_req); 897 return; 898 } 899 900 /* If preloading the FIFO, defer until TI command issued */ 901 if (s->rregs[ESP_CMD] != CMD_TI) { 902 return; 903 } 904 905 s->rregs[ESP_RINTR] |= INTR_BS; 906 esp_raise_irq(s); 907 break; 908 909 case STAT_ST: 910 switch (s->rregs[ESP_CMD]) { 911 case CMD_ICCS: 912 esp_fifo_push(s, s->status); 913 esp_set_phase(s, STAT_MI); 914 915 /* Process any message in phase data */ 916 esp_do_nodma(s); 917 break; 918 } 919 break; 920 921 case STAT_MI: 922 switch (s->rregs[ESP_CMD]) { 923 case CMD_ICCS: 924 esp_fifo_push(s, 0); 925 926 /* Raise end of command interrupt */ 927 s->rregs[ESP_RINTR] |= INTR_FC; 928 esp_raise_irq(s); 929 break; 930 } 931 break; 932 } 933 } 934 935 void esp_command_complete(SCSIRequest *req, size_t resid) 936 { 937 ESPState *s = req->hba_private; 938 int to_device = (esp_get_phase(s) == STAT_DO); 939 940 trace_esp_command_complete(); 941 942 /* 943 * Non-DMA transfers from the target will leave the last byte in 944 * the FIFO so don't reset ti_size in this case 945 */ 946 if (s->dma || to_device) { 947 if (s->ti_size != 0) { 948 trace_esp_command_complete_unexpected(); 949 } 950 } 951 952 s->async_len = 0; 953 if (req->status) { 954 trace_esp_command_complete_fail(); 955 } 956 s->status = req->status; 957 958 /* 959 * Switch to status phase. For non-DMA transfers from the target the last 960 * byte is still in the FIFO 961 */ 962 s->ti_size = 0; 963 964 switch (s->rregs[ESP_CMD]) { 965 case CMD_SEL | CMD_DMA: 966 case CMD_SEL: 967 case CMD_SELATN | CMD_DMA: 968 case CMD_SELATN: 969 /* 970 * No data phase for sequencer command so raise deferred bus service 971 * and function complete interrupt 972 */ 973 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC; 974 s->rregs[ESP_RSEQ] = SEQ_CD; 975 break; 976 977 case CMD_TI | CMD_DMA: 978 case CMD_TI: 979 s->rregs[ESP_CMD] = 0; 980 break; 981 } 982 983 /* Raise bus service interrupt to indicate change to STATUS phase */ 984 esp_set_phase(s, STAT_ST); 985 s->rregs[ESP_RINTR] |= INTR_BS; 986 esp_raise_irq(s); 987 988 if (s->current_req) { 989 scsi_req_unref(s->current_req); 990 s->current_req = NULL; 991 s->current_dev = NULL; 992 } 993 } 994 995 void esp_transfer_data(SCSIRequest *req, uint32_t len) 996 { 997 ESPState *s = req->hba_private; 998 uint32_t dmalen = esp_get_tc(s); 999 1000 trace_esp_transfer_data(dmalen, s->ti_size); 1001 s->async_len = len; 1002 s->async_buf = scsi_req_get_buf(req); 1003 1004 if (!s->data_ready) { 1005 s->data_ready = true; 1006 1007 switch (s->rregs[ESP_CMD]) { 1008 case CMD_SEL | CMD_DMA: 1009 case CMD_SEL: 1010 case CMD_SELATN | CMD_DMA: 1011 case CMD_SELATN: 1012 /* 1013 * Initial incoming data xfer is complete for sequencer command 1014 * so raise deferred bus service and function complete interrupt 1015 */ 1016 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC; 1017 s->rregs[ESP_RSEQ] = SEQ_CD; 1018 break; 1019 1020 case CMD_SELATNS | CMD_DMA: 1021 case CMD_SELATNS: 1022 /* 1023 * Initial incoming data xfer is complete so raise command 1024 * completion interrupt 1025 */ 1026 s->rregs[ESP_RINTR] |= INTR_BS; 1027 s->rregs[ESP_RSEQ] = SEQ_MO; 1028 break; 1029 1030 case CMD_TI | CMD_DMA: 1031 case CMD_TI: 1032 /* 1033 * Bus service interrupt raised because of initial change to 1034 * DATA phase 1035 */ 1036 s->rregs[ESP_CMD] = 0; 1037 s->rregs[ESP_RINTR] |= INTR_BS; 1038 break; 1039 } 1040 1041 esp_raise_irq(s); 1042 } 1043 1044 /* 1045 * Always perform the initial transfer upon reception of the next TI 1046 * command to ensure the DMA/non-DMA status of the command is correct. 1047 * It is not possible to use s->dma directly in the section below as 1048 * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the 1049 * async data transfer is delayed then s->dma is set incorrectly. 1050 */ 1051 1052 if (s->rregs[ESP_CMD] == (CMD_TI | CMD_DMA)) { 1053 /* When the SCSI layer returns more data, raise deferred INTR_BS */ 1054 esp_dma_ti_check(s); 1055 1056 esp_do_dma(s); 1057 } else if (s->rregs[ESP_CMD] == CMD_TI) { 1058 esp_do_nodma(s); 1059 } 1060 } 1061 1062 static void handle_ti(ESPState *s) 1063 { 1064 uint32_t dmalen; 1065 1066 if (s->dma && !s->dma_enabled) { 1067 s->dma_cb = handle_ti; 1068 return; 1069 } 1070 1071 if (s->dma) { 1072 dmalen = esp_get_tc(s); 1073 trace_esp_handle_ti(dmalen); 1074 esp_do_dma(s); 1075 } else { 1076 trace_esp_handle_ti(s->ti_size); 1077 esp_do_nodma(s); 1078 1079 if (esp_get_phase(s) == STAT_DO) { 1080 esp_nodma_ti_dataout(s); 1081 } 1082 } 1083 } 1084 1085 void esp_hard_reset(ESPState *s) 1086 { 1087 memset(s->rregs, 0, ESP_REGS); 1088 memset(s->wregs, 0, ESP_REGS); 1089 s->tchi_written = 0; 1090 s->ti_size = 0; 1091 s->async_len = 0; 1092 fifo8_reset(&s->fifo); 1093 fifo8_reset(&s->cmdfifo); 1094 s->dma = 0; 1095 s->dma_cb = NULL; 1096 1097 s->rregs[ESP_CFG1] = 7; 1098 } 1099 1100 static void esp_soft_reset(ESPState *s) 1101 { 1102 qemu_irq_lower(s->irq); 1103 qemu_irq_lower(s->drq_irq); 1104 esp_hard_reset(s); 1105 } 1106 1107 static void esp_bus_reset(ESPState *s) 1108 { 1109 bus_cold_reset(BUS(&s->bus)); 1110 } 1111 1112 static void parent_esp_reset(ESPState *s, int irq, int level) 1113 { 1114 if (level) { 1115 esp_soft_reset(s); 1116 } 1117 } 1118 1119 static void esp_run_cmd(ESPState *s) 1120 { 1121 uint8_t cmd = s->rregs[ESP_CMD]; 1122 1123 if (cmd & CMD_DMA) { 1124 s->dma = 1; 1125 /* Reload DMA counter. */ 1126 if (esp_get_stc(s) == 0) { 1127 esp_set_tc(s, 0x10000); 1128 } else { 1129 esp_set_tc(s, esp_get_stc(s)); 1130 } 1131 } else { 1132 s->dma = 0; 1133 } 1134 switch (cmd & CMD_CMD) { 1135 case CMD_NOP: 1136 trace_esp_mem_writeb_cmd_nop(cmd); 1137 break; 1138 case CMD_FLUSH: 1139 trace_esp_mem_writeb_cmd_flush(cmd); 1140 fifo8_reset(&s->fifo); 1141 break; 1142 case CMD_RESET: 1143 trace_esp_mem_writeb_cmd_reset(cmd); 1144 esp_soft_reset(s); 1145 break; 1146 case CMD_BUSRESET: 1147 trace_esp_mem_writeb_cmd_bus_reset(cmd); 1148 esp_bus_reset(s); 1149 if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) { 1150 s->rregs[ESP_RINTR] |= INTR_RST; 1151 esp_raise_irq(s); 1152 } 1153 break; 1154 case CMD_TI: 1155 trace_esp_mem_writeb_cmd_ti(cmd); 1156 handle_ti(s); 1157 break; 1158 case CMD_ICCS: 1159 trace_esp_mem_writeb_cmd_iccs(cmd); 1160 write_response(s); 1161 break; 1162 case CMD_MSGACC: 1163 trace_esp_mem_writeb_cmd_msgacc(cmd); 1164 s->rregs[ESP_RINTR] |= INTR_DC; 1165 s->rregs[ESP_RSEQ] = 0; 1166 s->rregs[ESP_RFLAGS] = 0; 1167 esp_raise_irq(s); 1168 break; 1169 case CMD_PAD: 1170 trace_esp_mem_writeb_cmd_pad(cmd); 1171 handle_pad(s); 1172 break; 1173 case CMD_SATN: 1174 trace_esp_mem_writeb_cmd_satn(cmd); 1175 break; 1176 case CMD_RSTATN: 1177 trace_esp_mem_writeb_cmd_rstatn(cmd); 1178 break; 1179 case CMD_SEL: 1180 trace_esp_mem_writeb_cmd_sel(cmd); 1181 handle_s_without_atn(s); 1182 break; 1183 case CMD_SELATN: 1184 trace_esp_mem_writeb_cmd_selatn(cmd); 1185 handle_satn(s); 1186 break; 1187 case CMD_SELATNS: 1188 trace_esp_mem_writeb_cmd_selatns(cmd); 1189 handle_satn_stop(s); 1190 break; 1191 case CMD_ENSEL: 1192 trace_esp_mem_writeb_cmd_ensel(cmd); 1193 s->rregs[ESP_RINTR] = 0; 1194 break; 1195 case CMD_DISSEL: 1196 trace_esp_mem_writeb_cmd_dissel(cmd); 1197 s->rregs[ESP_RINTR] = 0; 1198 esp_raise_irq(s); 1199 break; 1200 default: 1201 trace_esp_error_unhandled_command(cmd); 1202 break; 1203 } 1204 } 1205 1206 uint64_t esp_reg_read(ESPState *s, uint32_t saddr) 1207 { 1208 uint32_t val; 1209 1210 switch (saddr) { 1211 case ESP_FIFO: 1212 s->rregs[ESP_FIFO] = esp_fifo_pop(s); 1213 val = s->rregs[ESP_FIFO]; 1214 break; 1215 case ESP_RINTR: 1216 /* 1217 * Clear sequence step, interrupt register and all status bits 1218 * except TC 1219 */ 1220 val = s->rregs[ESP_RINTR]; 1221 s->rregs[ESP_RINTR] = 0; 1222 esp_lower_irq(s); 1223 s->rregs[ESP_RSTAT] &= STAT_TC | 7; 1224 /* 1225 * According to the datasheet ESP_RSEQ should be cleared, but as the 1226 * emulation currently defers information transfers to the next TI 1227 * command leave it for now so that pedantic guests such as the old 1228 * Linux 2.6 driver see the correct flags before the next SCSI phase 1229 * transition. 1230 * 1231 * s->rregs[ESP_RSEQ] = SEQ_0; 1232 */ 1233 break; 1234 case ESP_TCHI: 1235 /* Return the unique id if the value has never been written */ 1236 if (!s->tchi_written) { 1237 val = s->chip_id; 1238 } else { 1239 val = s->rregs[saddr]; 1240 } 1241 break; 1242 case ESP_RFLAGS: 1243 /* Bottom 5 bits indicate number of bytes in FIFO */ 1244 val = fifo8_num_used(&s->fifo); 1245 break; 1246 default: 1247 val = s->rregs[saddr]; 1248 break; 1249 } 1250 1251 trace_esp_mem_readb(saddr, val); 1252 return val; 1253 } 1254 1255 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val) 1256 { 1257 trace_esp_mem_writeb(saddr, s->wregs[saddr], val); 1258 switch (saddr) { 1259 case ESP_TCHI: 1260 s->tchi_written = true; 1261 /* fall through */ 1262 case ESP_TCLO: 1263 case ESP_TCMID: 1264 s->rregs[ESP_RSTAT] &= ~STAT_TC; 1265 break; 1266 case ESP_FIFO: 1267 if (!fifo8_is_full(&s->fifo)) { 1268 esp_fifo_push(s, val); 1269 } 1270 esp_do_nodma(s); 1271 break; 1272 case ESP_CMD: 1273 s->rregs[saddr] = val; 1274 esp_run_cmd(s); 1275 break; 1276 case ESP_WBUSID ... ESP_WSYNO: 1277 break; 1278 case ESP_CFG1: 1279 case ESP_CFG2: case ESP_CFG3: 1280 case ESP_RES3: case ESP_RES4: 1281 s->rregs[saddr] = val; 1282 break; 1283 case ESP_WCCF ... ESP_WTEST: 1284 break; 1285 default: 1286 trace_esp_error_invalid_write(val, saddr); 1287 return; 1288 } 1289 s->wregs[saddr] = val; 1290 } 1291 1292 static bool esp_mem_accepts(void *opaque, hwaddr addr, 1293 unsigned size, bool is_write, 1294 MemTxAttrs attrs) 1295 { 1296 return (size == 1) || (is_write && size == 4); 1297 } 1298 1299 static bool esp_is_before_version_5(void *opaque, int version_id) 1300 { 1301 ESPState *s = ESP(opaque); 1302 1303 version_id = MIN(version_id, s->mig_version_id); 1304 return version_id < 5; 1305 } 1306 1307 static bool esp_is_version_5(void *opaque, int version_id) 1308 { 1309 ESPState *s = ESP(opaque); 1310 1311 version_id = MIN(version_id, s->mig_version_id); 1312 return version_id >= 5; 1313 } 1314 1315 static bool esp_is_version_6(void *opaque, int version_id) 1316 { 1317 ESPState *s = ESP(opaque); 1318 1319 version_id = MIN(version_id, s->mig_version_id); 1320 return version_id >= 6; 1321 } 1322 1323 static bool esp_is_between_version_5_and_6(void *opaque, int version_id) 1324 { 1325 ESPState *s = ESP(opaque); 1326 1327 version_id = MIN(version_id, s->mig_version_id); 1328 return version_id >= 5 && version_id <= 6; 1329 } 1330 1331 int esp_pre_save(void *opaque) 1332 { 1333 ESPState *s = ESP(object_resolve_path_component( 1334 OBJECT(opaque), "esp")); 1335 1336 s->mig_version_id = vmstate_esp.version_id; 1337 return 0; 1338 } 1339 1340 static int esp_post_load(void *opaque, int version_id) 1341 { 1342 ESPState *s = ESP(opaque); 1343 int len, i; 1344 1345 version_id = MIN(version_id, s->mig_version_id); 1346 1347 if (version_id < 5) { 1348 esp_set_tc(s, s->mig_dma_left); 1349 1350 /* Migrate ti_buf to fifo */ 1351 len = s->mig_ti_wptr - s->mig_ti_rptr; 1352 for (i = 0; i < len; i++) { 1353 fifo8_push(&s->fifo, s->mig_ti_buf[i]); 1354 } 1355 1356 /* Migrate cmdbuf to cmdfifo */ 1357 for (i = 0; i < s->mig_cmdlen; i++) { 1358 fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]); 1359 } 1360 } 1361 1362 s->mig_version_id = vmstate_esp.version_id; 1363 return 0; 1364 } 1365 1366 const VMStateDescription vmstate_esp = { 1367 .name = "esp", 1368 .version_id = 7, 1369 .minimum_version_id = 3, 1370 .post_load = esp_post_load, 1371 .fields = (const VMStateField[]) { 1372 VMSTATE_BUFFER(rregs, ESPState), 1373 VMSTATE_BUFFER(wregs, ESPState), 1374 VMSTATE_INT32(ti_size, ESPState), 1375 VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5), 1376 VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5), 1377 VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5), 1378 VMSTATE_UINT32(status, ESPState), 1379 VMSTATE_UINT32_TEST(mig_deferred_status, ESPState, 1380 esp_is_before_version_5), 1381 VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState, 1382 esp_is_before_version_5), 1383 VMSTATE_UINT32(dma, ESPState), 1384 VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0, 1385 esp_is_before_version_5, 0, 16), 1386 VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4, 1387 esp_is_before_version_5, 16, 1388 sizeof(typeof_field(ESPState, mig_cmdbuf))), 1389 VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5), 1390 VMSTATE_UINT32(do_cmd, ESPState), 1391 VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5), 1392 VMSTATE_BOOL_TEST(data_ready, ESPState, esp_is_version_5), 1393 VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5), 1394 VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5), 1395 VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5), 1396 VMSTATE_UINT8_TEST(mig_ti_cmd, ESPState, 1397 esp_is_between_version_5_and_6), 1398 VMSTATE_UINT8_TEST(lun, ESPState, esp_is_version_6), 1399 VMSTATE_BOOL(drq_state, ESPState), 1400 VMSTATE_END_OF_LIST() 1401 }, 1402 }; 1403 1404 static void sysbus_esp_mem_write(void *opaque, hwaddr addr, 1405 uint64_t val, unsigned int size) 1406 { 1407 SysBusESPState *sysbus = opaque; 1408 ESPState *s = ESP(&sysbus->esp); 1409 uint32_t saddr; 1410 1411 saddr = addr >> sysbus->it_shift; 1412 esp_reg_write(s, saddr, val); 1413 } 1414 1415 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr, 1416 unsigned int size) 1417 { 1418 SysBusESPState *sysbus = opaque; 1419 ESPState *s = ESP(&sysbus->esp); 1420 uint32_t saddr; 1421 1422 saddr = addr >> sysbus->it_shift; 1423 return esp_reg_read(s, saddr); 1424 } 1425 1426 static const MemoryRegionOps sysbus_esp_mem_ops = { 1427 .read = sysbus_esp_mem_read, 1428 .write = sysbus_esp_mem_write, 1429 .endianness = DEVICE_NATIVE_ENDIAN, 1430 .valid.accepts = esp_mem_accepts, 1431 }; 1432 1433 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr, 1434 uint64_t val, unsigned int size) 1435 { 1436 SysBusESPState *sysbus = opaque; 1437 ESPState *s = ESP(&sysbus->esp); 1438 1439 trace_esp_pdma_write(size); 1440 1441 switch (size) { 1442 case 1: 1443 esp_pdma_write(s, val); 1444 break; 1445 case 2: 1446 esp_pdma_write(s, val >> 8); 1447 esp_pdma_write(s, val); 1448 break; 1449 } 1450 esp_do_dma(s); 1451 } 1452 1453 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr, 1454 unsigned int size) 1455 { 1456 SysBusESPState *sysbus = opaque; 1457 ESPState *s = ESP(&sysbus->esp); 1458 uint64_t val = 0; 1459 1460 trace_esp_pdma_read(size); 1461 1462 switch (size) { 1463 case 1: 1464 val = esp_pdma_read(s); 1465 break; 1466 case 2: 1467 val = esp_pdma_read(s); 1468 val = (val << 8) | esp_pdma_read(s); 1469 break; 1470 } 1471 esp_do_dma(s); 1472 return val; 1473 } 1474 1475 static void *esp_load_request(QEMUFile *f, SCSIRequest *req) 1476 { 1477 ESPState *s = container_of(req->bus, ESPState, bus); 1478 1479 scsi_req_ref(req); 1480 s->current_req = req; 1481 return s; 1482 } 1483 1484 static const MemoryRegionOps sysbus_esp_pdma_ops = { 1485 .read = sysbus_esp_pdma_read, 1486 .write = sysbus_esp_pdma_write, 1487 .endianness = DEVICE_NATIVE_ENDIAN, 1488 .valid.min_access_size = 1, 1489 .valid.max_access_size = 4, 1490 .impl.min_access_size = 1, 1491 .impl.max_access_size = 2, 1492 }; 1493 1494 static const struct SCSIBusInfo esp_scsi_info = { 1495 .tcq = false, 1496 .max_target = ESP_MAX_DEVS, 1497 .max_lun = 7, 1498 1499 .load_request = esp_load_request, 1500 .transfer_data = esp_transfer_data, 1501 .complete = esp_command_complete, 1502 .cancel = esp_request_cancelled 1503 }; 1504 1505 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level) 1506 { 1507 SysBusESPState *sysbus = SYSBUS_ESP(opaque); 1508 ESPState *s = ESP(&sysbus->esp); 1509 1510 switch (irq) { 1511 case 0: 1512 parent_esp_reset(s, irq, level); 1513 break; 1514 case 1: 1515 esp_dma_enable(s, irq, level); 1516 break; 1517 } 1518 } 1519 1520 static void sysbus_esp_realize(DeviceState *dev, Error **errp) 1521 { 1522 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 1523 SysBusESPState *sysbus = SYSBUS_ESP(dev); 1524 ESPState *s = ESP(&sysbus->esp); 1525 1526 if (!qdev_realize(DEVICE(s), NULL, errp)) { 1527 return; 1528 } 1529 1530 sysbus_init_irq(sbd, &s->irq); 1531 sysbus_init_irq(sbd, &s->drq_irq); 1532 assert(sysbus->it_shift != -1); 1533 1534 s->chip_id = TCHI_FAS100A; 1535 memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops, 1536 sysbus, "esp-regs", ESP_REGS << sysbus->it_shift); 1537 sysbus_init_mmio(sbd, &sysbus->iomem); 1538 memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops, 1539 sysbus, "esp-pdma", 4); 1540 sysbus_init_mmio(sbd, &sysbus->pdma); 1541 1542 qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2); 1543 1544 scsi_bus_init(&s->bus, sizeof(s->bus), dev, &esp_scsi_info); 1545 } 1546 1547 static void sysbus_esp_hard_reset(DeviceState *dev) 1548 { 1549 SysBusESPState *sysbus = SYSBUS_ESP(dev); 1550 ESPState *s = ESP(&sysbus->esp); 1551 1552 esp_hard_reset(s); 1553 } 1554 1555 static void sysbus_esp_init(Object *obj) 1556 { 1557 SysBusESPState *sysbus = SYSBUS_ESP(obj); 1558 1559 object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP); 1560 } 1561 1562 static const VMStateDescription vmstate_sysbus_esp_scsi = { 1563 .name = "sysbusespscsi", 1564 .version_id = 2, 1565 .minimum_version_id = 1, 1566 .pre_save = esp_pre_save, 1567 .fields = (const VMStateField[]) { 1568 VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2), 1569 VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState), 1570 VMSTATE_END_OF_LIST() 1571 } 1572 }; 1573 1574 static void sysbus_esp_class_init(ObjectClass *klass, void *data) 1575 { 1576 DeviceClass *dc = DEVICE_CLASS(klass); 1577 1578 dc->realize = sysbus_esp_realize; 1579 dc->reset = sysbus_esp_hard_reset; 1580 dc->vmsd = &vmstate_sysbus_esp_scsi; 1581 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 1582 } 1583 1584 static void esp_finalize(Object *obj) 1585 { 1586 ESPState *s = ESP(obj); 1587 1588 fifo8_destroy(&s->fifo); 1589 fifo8_destroy(&s->cmdfifo); 1590 } 1591 1592 static void esp_init(Object *obj) 1593 { 1594 ESPState *s = ESP(obj); 1595 1596 fifo8_create(&s->fifo, ESP_FIFO_SZ); 1597 fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ); 1598 } 1599 1600 static void esp_class_init(ObjectClass *klass, void *data) 1601 { 1602 DeviceClass *dc = DEVICE_CLASS(klass); 1603 1604 /* internal device for sysbusesp/pciespscsi, not user-creatable */ 1605 dc->user_creatable = false; 1606 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 1607 } 1608 1609 static const TypeInfo esp_info_types[] = { 1610 { 1611 .name = TYPE_SYSBUS_ESP, 1612 .parent = TYPE_SYS_BUS_DEVICE, 1613 .instance_init = sysbus_esp_init, 1614 .instance_size = sizeof(SysBusESPState), 1615 .class_init = sysbus_esp_class_init, 1616 }, 1617 { 1618 .name = TYPE_ESP, 1619 .parent = TYPE_DEVICE, 1620 .instance_init = esp_init, 1621 .instance_finalize = esp_finalize, 1622 .instance_size = sizeof(ESPState), 1623 .class_init = esp_class_init, 1624 }, 1625 }; 1626 1627 DEFINE_TYPES(esp_info_types) 1628