aboutsummaryrefslogtreecommitdiff
path: root/hw/scsi
AgeCommit message (Collapse)AuthorFilesLines
2021-06-15esp: allow non-DMA callback in esp_transfer_data() initial transferMark Cave-Ayland1-12/+2
The current implementation only resumes DMA transfers when incoming data is received from the target device, but this is also required for non-DMA transfers with the next set of non-DMA changes. Rather than duplicate the DMA/non-DMA dispatch logic in the initial transfer section, update the code so that the initial transfer section can just fallthrough to the main DMA/non-DMA dispatch logic. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20210519100803.10293-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15esp: only set ESP_RSEQ at the start of the select sequenceMark Cave-Ayland1-2/+9
When processing a command to select a target and send a CDB, the ESP device maintains a sequence step register so that if an error occurs the host can determine which part of the selection/CDB submission sequence failed. The old Linux 2.6 driver is really pedantic here: it checks the sequence step register even if a command succeeds and complains loudly on the console if the sequence step register doesn't match the expected bus phase and interrupt flags. This reason this mismatch occurs is because the ESP emulation currently doesn't update the bus phase until the next TI (Transfer Information) command and so the cleared sequence step register is considered invalid for the stale bus phase. Normally this isn't an issue as the host only checks the sequence step register if an error occurs but the old Linux 2.6 driver does this in several places causing a large stream of "esp0: STEP_ASEL for tgt 0" messages to appear on the console during the boot process. Fix this by not clearing the sequence step register when reading the interrupt register and clearing the DMA status, so the guest sees a valid sequence step and bus phase combination at the end of the command phase. No other change is required since the sequence step register is correctly updated throughout the selection/CDB submission sequence once one of the select commands is issued. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Fixes: 1b9e48a5bd ("esp: implement non-DMA transfers in PDMA mode") Message-Id: <20210518212511.21688-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15esp: only assert INTR_DC interrupt flag if selection failsMark Cave-Ayland1-1/+1
The datasheet sequence tables confirm that when a target selection fails, only the INTR_DC interrupt flag should be asserted. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Fixes: cf47a41e05 ("esp: latch individual bits in ESP_RINTR register") Message-Id: <20210518212511.21688-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-15block/scsi: correctly emulate the VPD block limits pageMaxim Levitsky1-2/+7
When the device doesn't support the VPD block limits page, we emulate it even for SCSI passthrough. As a part of the emulation we need to add it to the 'Supported VPD Pages' The code that does this adds it to the page, but it doesn't increase the length of the data to be copied to the guest, thus the guest never sees the VPD block limits page as supported. Bump the transfer size by 1 in this case. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-Id: <20201217165612.942849-6-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-06-02docs: fix references to docs/devel/tracing.rstStefano Garzarella1-1/+1
Commit e50caf4a5c ("tracing: convert documentation to rST") converted docs/devel/tracing.txt to docs/devel/tracing.rst. We still have several references to the old file, so let's fix them with the following command: sed -i s/tracing.txt/tracing.rst/ $(git grep -l docs/devel/tracing.txt) Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210517151702.109066-2-sgarzare@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-05-26hw/scsi: Fix sector translation bug in scsi_unmap_complete_noioKit Westneat1-5/+7
check_lba_range expects sectors to be expressed in original qdev blocksize, but scsi_unmap_complete_noio was translating them to 512 block sizes, which was causing sense errors in the larger LBAs in devices using a 4k block size. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/345 Signed-off-by: Kit Westneat <kit.westneat@gmail.com> Message-Id: <20210521142829.326217-1-kit.westneat@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-05-16Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell1-18/+38
pc,pci,virtio: bugfixes, improvements Fixes all over the place. Faster boot for virtio. ioeventfd support for mmio. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 14 May 2021 15:27:13 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: Fix build with 64 bits time_t vhost-vdpa: Make vhost_vdpa_get_device_id() static hw/virtio: enable ioeventfd configuring for mmio hw/smbios: support for type 41 (onboard devices extended information) checkpatch: Fix use of uninitialized value virtio-scsi: Configure all host notifiers in a single MR transaction virtio-scsi: Set host notifiers and callbacks separately virtio-blk: Configure all host notifiers in a single MR transaction virtio-blk: Fix rollback path in virtio_blk_data_plane_start() pc-dimm: remove unnecessary get_vmstate_memory_region() method amd_iommu: fix wrong MMIO operations virtio-net: Constify VirtIOFeature feature_sizes[] virtio-blk: Constify VirtIOFeature feature_sizes[] hw/virtio: Pass virtio_feature_get_config_size() a const argument x86: acpi: use offset instead of pointer when using build_header() amd_iommu: Fix pte_override_page_mask() Signed-off-by: Peter Maydell <peter.maydell@linaro.org> # Conflicts: # hw/arm/virt.c
2021-05-14virtio-scsi: Configure all host notifiers in a single MR transactionGreg Kurz1-0/+16
This allows the virtio-scsi-pci device to batch the setup of all its host notifiers. This significantly improves boot time of VMs with a high number of vCPUs, e.g. from 6m5.563s down to 1m2.884s for a pseries machine with 384 vCPUs. Note that memory_region_transaction_commit() must be called before virtio_bus_cleanup_host_notifier() because the latter might close ioeventfds that the transaction still assumes to be around when it commits. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <20210407143501.244343-5-groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-05-14virtio-scsi: Set host notifiers and callbacks separatelyGreg Kurz1-18/+22
Host notifiers are guaranteed to be idle until the callbacks are hooked up with virtio_queue_aio_set_host_notifier_handler(). They thus don't need to be set or unset with the AioContext lock held. Do this outside the critical section, like virtio-blk already does : basically downgrading virtio_scsi_vring_init() to only setup the host notifier and set the callback in the caller. This will allow to batch addition/deletion of ioeventds in a single memory transaction, which is expected to greatly improve initialization time. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <20210407143501.244343-4-groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-05-02Do not include cpu.h if it's not really necessaryThomas Huth1-1/+0
Stop including cpu.h in files that don't need it. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210416171314.2074665-4-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-04-19mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392)Michael Tokarev2-7/+0
While processing SCSI i/o requests in mptsas_process_scsi_io_request(), the Megaraid emulator appends new MPTSASRequest object 'req' to the 's->pending' queue. In case of an error, this same object gets dequeued in mptsas_free_request() only if SCSIRequest object 'req->sreq' is initialised. This may lead to a use-after-free issue. Since s->pending is actually not used, simply remove it from MPTSASState. Cc: qemu-stable@nongnu.org Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Message-id: 20210419134247.1467982-1-f4bug@amsat.org Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392) Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device") [PMD: Reworded description, added more tags] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12esp: ensure that do_cmd is set to zero before submitting an ESP select commandMark Cave-Ayland1-0/+2
When a CDB has been received and is about to be submitted to the SCSI layer via one of the ESP select commands, ensure that do_cmd is set to zero before executing the command. Otherwise a guest executing 2 valid CDBs in quick sequence can invoke the SCSI .transfer_data callback again before do_cmd is set to zero by the callback function triggering an assert at the start of esp_transfer_data(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-12-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't reset async_len directly in esp_select() if cancelling requestMark Cave-Ayland1-1/+1
Instead let the SCSI layer invoke the .cancel callback itself to cancel and reset the request state. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-11-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't overflow cmdfifo if TC is larger than the cmdfifo sizeMark Cave-Ayland1-0/+1
If a guest transfers the message out/command phase data using DMA with a TC that is larger than the cmdfifo size then the cmdfifo overflows triggering an assert. Limit the size of the transfer to the free space available in cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1919036 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-10-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't overflow cmdfifo in get_cmd()Mark Cave-Ayland1-0/+2
If the guest tries to read a CDB using DMA and cmdfifo is not empty then it is possible to overflow cmdfifo. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of the CDB transferred to cmdfifo is limited to the available free space within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-9-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't underflow cmdfifo in do_cmd()Mark Cave-Ayland1-2/+4
If the guest tries to execute a CDB when cmdfifo is not empty before the start of the message out phase then clearing the message out phase data will cause cmdfifo to underflow due to cmdfifo_cdb_offset being larger than the amount of data within. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of esp_fifo_pop_buf() is limited to the size of the data within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-8-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: ensure cmdfifo is not empty and current_dev is non-NULLMark Cave-Ayland1-0/+3
When about to execute a SCSI command, ensure that cmdfifo is not empty and current_dev is non-NULL. This can happen if the guest tries to execute a TI (Transfer Information) command without issuing one of the select commands first. Buglink: https://bugs.launchpad.net/qemu/+bug/1910723 Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-7-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf()Mark Cave-Ayland1-12/+28
The const pointer returned by fifo8_pop_buf() lies directly within the array used to model the FIFO. Building with address sanitizers enabled shows that if the caller expects a minimum number of bytes present then if the FIFO is nearly full, the caller may unexpectedly access past the end of the array. Introduce esp_fifo_pop_buf() which takes a destination buffer and performs a memcpy() in it to guarantee that the caller cannot overwrite the FIFO array and update all callers to use it. Similarly add underflow protection similar to esp_fifo_push() and esp_fifo_pop() so that instead of triggering an assert() the operation becomes a no-op. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210407195801.685-6-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: consolidate esp_cmdfifo_pop() into esp_fifo_pop()Mark Cave-Ayland1-14/+6
Each FIFO currently has its own pop functions with the only difference being the capacity check. The original reason for this was that the fifo8 implementation doesn't have a formal API for retrieving the FIFO capacity, however there are multiple examples within QEMU where the capacity field is accessed directly. Change esp_fifo_pop() to access the FIFO capacity directly and then consolidate esp_cmdfifo_pop() into esp_fifo_pop(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-5-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: consolidate esp_cmdfifo_push() into esp_fifo_push()Mark Cave-Ayland1-19/+8
Each FIFO currently has its own push functions with the only difference being the capacity check. The original reason for this was that the fifo8 implementation doesn't have a formal API for retrieving the FIFO capacity, however there are multiple examples within QEMU where the capacity field is accessed directly. Change esp_fifo_push() to access the FIFO capacity directly and then consolidate esp_cmdfifo_push() into esp_fifo_push(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-4-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: rework write_response() to avoid using the FIFO for DMA transactionsMark Cave-Ayland1-7/+6
The code for write_response() has always used the FIFO to store the data for the status/message in phases, even for DMA transactions. Switch to using a separate buffer that can be used directly for DMA transactions and restrict the FIFO use to the non-DMA case. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-3-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: always check current_req is not NULL before use in DMA callbacksMark Cave-Ayland1-5/+14
After issuing a SCSI command the SCSI layer can call the SCSIBusInfo .cancel callback which resets both current_req and current_dev to NULL. If any data is left in the transfer buffer (async_len != 0) then the next TI (Transfer Information) command will attempt to reference the NULL pointer causing a segfault. Buglink: https://bugs.launchpad.net/qemu/+bug/1910723 Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-2-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: fix setting of ESPState mig_version_id when launching QEMU with -S optionMark Cave-Ayland2-3/+5
If QEMU is launched with the -S option then the ESPState mig_version_id property is left unset due to the ordering of the VMState fields in the VMStateDescription for sysbusespscsi and pciespscsi. If the VM is migrated and restored in this stopped state, the version tests in the vmstate_esp VMStateDescription and esp_post_load() become confused causing the migration to fail. Fix the ordering problem by moving the setting of mig_version_id to a common esp_pre_save() function which is invoked first by both sysbusespscsi and pciespscsi rather than at the point where ESPState is itself serialised into the migration stream. Buglink: https://bugs.launchpad.net/qemu/+bug/1922611 Fixes: 0bd005be78 ("esp: add vmstate_esp version to embedded ESPState") Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210407124842.32695-1-mark.cave-ayland@ilande.co.uk>
2021-03-18hw/scsi: remove 'scsi-disk' deviceDaniel P. Berrangé1-62/+0
The 'scsi-hd' and 'scsi-cd' devices provide suitable alternatives. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-03-09sysemu: Let VMChangeStateHandler take boolean 'running' argumentPhilippe Mathieu-Daudé1-1/+1
The 'running' argument from VMChangeStateHandler does not require other value than 0 / 1. Make it a plain boolean. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20210111152020.1422021-3-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-03-09scsi: Silence gcc warningEric Blake1-0/+1
On Fedora 33, gcc 10.2.1 notes that scsi_cdb_length(buf) can set len==-1, which in turn overflows g_malloc(): [5/5] Linking target qemu-system-x86_64 In function ‘scsi_disk_new_request_dump’, inlined from ‘scsi_new_request’ at ../hw/scsi/scsi-disk.c:2608:9: ../hw/scsi/scsi-disk.c:2582:19: warning: argument 1 value ‘18446744073709551612’ exceeds maximum object size 9223372036854775807 [-Walloc-size-larger-than=] 2582 | line_buffer = g_malloc(len * 5 + 1); | ^ Silence it with a decent assertion, since we only convert a buffer to bytes when we have a valid cdb length. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210209152350.207958-1-eblake@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-03-09Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20210307' ↵Peter Maydell3-318/+715
into staging qemu-sparc queue # gpg: Signature made Sun 07 Mar 2021 12:07:13 GMT # gpg: using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F # gpg: issuer "mark.cave-ayland@ilande.co.uk" # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full] # Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F * remotes/mcayland/tags/qemu-sparc-20210307: (42 commits) esp: add support for unaligned accesses esp: implement non-DMA transfers in PDMA mode esp: add trivial implementation of the ESP_RFLAGS register esp: convert cmdbuf from array to Fifo8 esp: convert ti_buf from array to Fifo8 esp: transition to message out phase after SATN and stop command esp: add maxlen parameter to get_cmd() esp: raise interrupt after every non-DMA byte transferred to the FIFO esp: remove old deferred command completion mechanism esp: defer command completion interrupt on incoming data transfers esp: latch individual bits in ESP_RINTR register esp: implement FIFO flush command esp: add 4 byte PDMA read and write transfers esp: remove pdma_origin from ESPState esp: use FIFO for PDMA transfers between initiator and device esp: fix PDMA target selection esp: rename get_cmd_cb() to esp_select() esp: remove CMD pdma_origin esp: use in-built TC to determine PDMA transfer length esp: use ti_wptr/ti_rptr to manage the current FIFO position for PDMA ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-07esp: add support for unaligned accessesMark Cave-Ayland1-7/+41
When the MacOS toolbox ROM transfers data from a target device to an unaligned memory address, the first/last byte of a 16-bit transfer needs to be handled separately. This means that the first byte is preloaded into the FIFO before the transfer, or the last byte remains in the FIFO after the transfer. The result of this is that the PDMA routines must be updated so that the FIFO is loaded/unloaded if the last 16-bit word is used (rather than the last byte) and any remaining byte from a FIFO wraparound is handled correctly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-43-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: implement non-DMA transfers in PDMA modeMark Cave-Ayland1-36/+97
The MacOS toolbox ROM uses non-DMA TI commands to handle the first/last byte of an unaligned 16-bit transfer to memory. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-42-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: add trivial implementation of the ESP_RFLAGS registerMark Cave-Ayland1-0/+4
The bottom 5 bits contain the number of bytes remaining in the FIFO which is trivial to implement with Fifo8 (the remaining bits are unimplemented and left as 0 for now). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-41-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: convert cmdbuf from array to Fifo8Mark Cave-Ayland1-55/+96
Rename ESP_CMDBUF_SZ to ESP_CMDFIFO_SZ and cmdbuf_cdb_offset to cmdfifo_cdb_offset to indicate that the command buffer type has changed from an array to a Fifo8. This also enables us to remove the ESPState field cmdlen since the command length is now simply the number of elements used in cmdfifo. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-40-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: convert ti_buf from array to Fifo8Mark Cave-Ayland1-44/+74
Rename TI_BUFSZ to ESP_FIFO_SZ since this constant is really describing the size of the FIFO and is not directly related to the TI size. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-39-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: transition to message out phase after SATN and stop commandMark Cave-Ayland1-14/+58
The SCSI bus should remain in the message out phase after the SATN and stop command rather than transitioning to the command phase. A new ESPState variable cmdbuf_cdb_offset is added which stores the offset of the CDB from the start of cmdbuf when accumulating extended message out phase data. Currently any extended message out data is discarded in do_cmd() before the CDB is processed in do_busid_cmd(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-38-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: add maxlen parameter to get_cmd()Mark Cave-Ayland1-9/+11
Some guests use a mixture of DMA and non-DMA transfers in combination with the SATN and stop command to transfer message out phase and command phase bytes to the target. Prepare for the next commit by adding a maxlen parameter to get_cmd() to allow partial transfers. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-37-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: raise interrupt after every non-DMA byte transferred to the FIFOMark Cave-Ayland1-0/+6
This matches the description in the datasheet and is required as support for non-DMA transfers is added. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-36-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove old deferred command completion mechanismMark Cave-Ayland1-26/+9
Commit ea84a44250 "scsi: esp: Defer command completion until previous interrupts have been handled" provided a mechanism to delay the command completion interrupt until ESP_RINTR is read after the command has completed. With the previous fixes for latching the ESP_RINTR bits and deferring the setting of the command completion interrupt for incoming data to the SCSI callback, this workaround is no longer required and can be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-35-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: defer command completion interrupt on incoming data transfersMark Cave-Ayland1-13/+53
The MacOS toolbox ROM issues a command to the ESP controller as part of its "FAST" SCSI routines and then proceeds to read the incoming data soon after receiving the command completion interrupt. Unfortunately due to SCSI block transfers being asynchronous the incoming data may not yet be present causing an underflow error. Resolve this by waiting for the SCSI subsystem transfer_data callback before raising the command completion interrupt. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-34-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: latch individual bits in ESP_RINTR registerMark Cave-Ayland1-16/+13
Currently the ESP_RINTR register is set to a specific value as required within the ESP state machine. In order to implement the upcoming deferred interrupt functionality it is necessary to set individual bits within ESP_RINTR so that a deferred interrupt will not overwrite the value of any other interrupt bits. This also requires fixing up a few locations where the ESP_RINTR and ESP_RSEQ registers are set/reset unexpectedly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-33-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: implement FIFO flush commandMark Cave-Ayland1-0/+2
At this point it is now possible to properly implement the FIFO flush command without causing guest errors. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-32-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: add 4 byte PDMA read and write transfersMark Cave-Ayland1-2/+4
The MacOS toolbox ROM performs 4 byte reads/writes when transferring data to and from the target. Since the SCSI bus is 16-bits wide, use the memory API to split a 4 byte access into 2 x 2 byte accesses. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-31-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove pdma_origin from ESPStateMark Cave-Ayland1-66/+8
Now that all data is transferred via the FIFO (ti_buf) there is no need to track the source buffer being used for the data transfer. This also eliminates the need for a separate subsection for PDMA state migration. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-30-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: use FIFO for PDMA transfers between initiator and deviceMark Cave-Ayland1-34/+75
PDMA as implemented on the Quadra 800 uses DREQ to load data into the FIFO up to a maximum of 16 bytes at a time. The MacOS toolbox ROM requires this because it mixes FIFO and PDMA transfers whilst checking the FIFO status and counter registers to ensure success. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-29-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: fix PDMA target selectionMark Cave-Ayland1-19/+34
Currently the target selection for PDMA is done after the SCSI command has been delivered which is not correct. Perform target selection as part of the initial get_cmd() call when the command is submitted: if no target is present, don't raise DRQ. If the target is present then switch to the command phase since the MacOS toolbox ROM checks for this before attempting to submit the SCSI command. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-28-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: rename get_cmd_cb() to esp_select()Mark Cave-Ayland1-5/+5
This better describes the purpose of the function. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-27-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove CMD pdma_originMark Cave-Ayland1-10/+12
The cmdbuf is really just a copy of FIFO data (including extra message phase bytes) so its pdma_origin is effectively TI. Fortunately we already know when we are receiving a SCSI command since do_cmd == 1 which enables us to distinguish between the two cases in esp_pdma_read()/esp_pdma_write(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-26-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: use in-built TC to determine PDMA transfer lengthMark Cave-Ayland1-15/+13
Real hardware simply counts down using the in-built TC to determine when the the PDMA request is complete. Use the TC to determine the PDMA transfer length which then enables us to remove the redundant pdma_len variable. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-25-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: use ti_wptr/ti_rptr to manage the current FIFO position for PDMAMark Cave-Ayland1-15/+8
This eliminates the last user of the PDMA-specific pdma_cur variable which can now be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-24-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: move PDMA length adjustments into esp_pdma_read()/esp_pdma_write()Mark Cave-Ayland1-10/+14
Here the updates to async_len and ti_size are moved into the corresponding esp_pdma_read()/esp_pdma_write() function to eliminate the reference to pdma_cur in do_dma_pdma_cb(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-23-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove redundant pdma_start from ESPStateMark Cave-Ayland1-17/+2
Now that PDMA SCSI commands are accumulated in cmdbuf in the same way as normal commands, the existing logic for locating the start of the SCSI command in cmdbuf via cmdlen can be used. This enables the PDMA-specific pdma_start and also get_pdma_buf() to be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-22-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove the buf and buflen parameters from get_cmd()Mark Cave-Ayland1-5/+6
Now that all SCSI commands are accumulated in cmdbuf, remove the buf and buflen parameters from get_cmd() since these always reference cmdbuf and ESP_CMDBUF_SZ respectively. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-21-mark.cave-ayland@ilande.co.uk>
generated by cgit v1.1 at 2024-10-19 23:57:27 +0000