aboutsummaryrefslogtreecommitdiff
path: root/hw/scsi
AgeCommit message (Collapse)Author
2021-04-19mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392)Michael Tokarev
While processing SCSI i/o requests in mptsas_process_scsi_io_request(), the Megaraid emulator appends new MPTSASRequest object 'req' to the 's->pending' queue. In case of an error, this same object gets dequeued in mptsas_free_request() only if SCSIRequest object 'req->sreq' is initialised. This may lead to a use-after-free issue. Since s->pending is actually not used, simply remove it from MPTSASState. Cc: qemu-stable@nongnu.org Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Message-id: 20210419134247.1467982-1-f4bug@amsat.org Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392) Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device") [PMD: Reworded description, added more tags] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12esp: ensure that do_cmd is set to zero before submitting an ESP select commandMark Cave-Ayland
When a CDB has been received and is about to be submitted to the SCSI layer via one of the ESP select commands, ensure that do_cmd is set to zero before executing the command. Otherwise a guest executing 2 valid CDBs in quick sequence can invoke the SCSI .transfer_data callback again before do_cmd is set to zero by the callback function triggering an assert at the start of esp_transfer_data(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-12-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't reset async_len directly in esp_select() if cancelling requestMark Cave-Ayland
Instead let the SCSI layer invoke the .cancel callback itself to cancel and reset the request state. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-11-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't overflow cmdfifo if TC is larger than the cmdfifo sizeMark Cave-Ayland
If a guest transfers the message out/command phase data using DMA with a TC that is larger than the cmdfifo size then the cmdfifo overflows triggering an assert. Limit the size of the transfer to the free space available in cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1919036 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-10-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't overflow cmdfifo in get_cmd()Mark Cave-Ayland
If the guest tries to read a CDB using DMA and cmdfifo is not empty then it is possible to overflow cmdfifo. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of the CDB transferred to cmdfifo is limited to the available free space within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-9-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: don't underflow cmdfifo in do_cmd()Mark Cave-Ayland
If the guest tries to execute a CDB when cmdfifo is not empty before the start of the message out phase then clearing the message out phase data will cause cmdfifo to underflow due to cmdfifo_cdb_offset being larger than the amount of data within. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of esp_fifo_pop_buf() is limited to the size of the data within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-8-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: ensure cmdfifo is not empty and current_dev is non-NULLMark Cave-Ayland
When about to execute a SCSI command, ensure that cmdfifo is not empty and current_dev is non-NULL. This can happen if the guest tries to execute a TI (Transfer Information) command without issuing one of the select commands first. Buglink: https://bugs.launchpad.net/qemu/+bug/1910723 Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-7-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf()Mark Cave-Ayland
The const pointer returned by fifo8_pop_buf() lies directly within the array used to model the FIFO. Building with address sanitizers enabled shows that if the caller expects a minimum number of bytes present then if the FIFO is nearly full, the caller may unexpectedly access past the end of the array. Introduce esp_fifo_pop_buf() which takes a destination buffer and performs a memcpy() in it to guarantee that the caller cannot overwrite the FIFO array and update all callers to use it. Similarly add underflow protection similar to esp_fifo_push() and esp_fifo_pop() so that instead of triggering an assert() the operation becomes a no-op. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210407195801.685-6-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: consolidate esp_cmdfifo_pop() into esp_fifo_pop()Mark Cave-Ayland
Each FIFO currently has its own pop functions with the only difference being the capacity check. The original reason for this was that the fifo8 implementation doesn't have a formal API for retrieving the FIFO capacity, however there are multiple examples within QEMU where the capacity field is accessed directly. Change esp_fifo_pop() to access the FIFO capacity directly and then consolidate esp_cmdfifo_pop() into esp_fifo_pop(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-5-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: consolidate esp_cmdfifo_push() into esp_fifo_push()Mark Cave-Ayland
Each FIFO currently has its own push functions with the only difference being the capacity check. The original reason for this was that the fifo8 implementation doesn't have a formal API for retrieving the FIFO capacity, however there are multiple examples within QEMU where the capacity field is accessed directly. Change esp_fifo_push() to access the FIFO capacity directly and then consolidate esp_cmdfifo_push() into esp_fifo_push(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-4-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: rework write_response() to avoid using the FIFO for DMA transactionsMark Cave-Ayland
The code for write_response() has always used the FIFO to store the data for the status/message in phases, even for DMA transactions. Switch to using a separate buffer that can be used directly for DMA transactions and restrict the FIFO use to the non-DMA case. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407195801.685-3-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: always check current_req is not NULL before use in DMA callbacksMark Cave-Ayland
After issuing a SCSI command the SCSI layer can call the SCSIBusInfo .cancel callback which resets both current_req and current_dev to NULL. If any data is left in the transfer buffer (async_len != 0) then the next TI (Transfer Information) command will attempt to reference the NULL pointer causing a segfault. Buglink: https://bugs.launchpad.net/qemu/+bug/1910723 Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-2-mark.cave-ayland@ilande.co.uk>
2021-04-12esp: fix setting of ESPState mig_version_id when launching QEMU with -S optionMark Cave-Ayland
If QEMU is launched with the -S option then the ESPState mig_version_id property is left unset due to the ordering of the VMState fields in the VMStateDescription for sysbusespscsi and pciespscsi. If the VM is migrated and restored in this stopped state, the version tests in the vmstate_esp VMStateDescription and esp_post_load() become confused causing the migration to fail. Fix the ordering problem by moving the setting of mig_version_id to a common esp_pre_save() function which is invoked first by both sysbusespscsi and pciespscsi rather than at the point where ESPState is itself serialised into the migration stream. Buglink: https://bugs.launchpad.net/qemu/+bug/1922611 Fixes: 0bd005be78 ("esp: add vmstate_esp version to embedded ESPState") Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210407124842.32695-1-mark.cave-ayland@ilande.co.uk>
2021-03-18hw/scsi: remove 'scsi-disk' deviceDaniel P. Berrangé
The 'scsi-hd' and 'scsi-cd' devices provide suitable alternatives. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-03-09sysemu: Let VMChangeStateHandler take boolean 'running' argumentPhilippe Mathieu-Daudé
The 'running' argument from VMChangeStateHandler does not require other value than 0 / 1. Make it a plain boolean. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20210111152020.1422021-3-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-03-09scsi: Silence gcc warningEric Blake
On Fedora 33, gcc 10.2.1 notes that scsi_cdb_length(buf) can set len==-1, which in turn overflows g_malloc(): [5/5] Linking target qemu-system-x86_64 In function ‘scsi_disk_new_request_dump’, inlined from ‘scsi_new_request’ at ../hw/scsi/scsi-disk.c:2608:9: ../hw/scsi/scsi-disk.c:2582:19: warning: argument 1 value ‘18446744073709551612’ exceeds maximum object size 9223372036854775807 [-Walloc-size-larger-than=] 2582 | line_buffer = g_malloc(len * 5 + 1); | ^ Silence it with a decent assertion, since we only convert a buffer to bytes when we have a valid cdb length. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210209152350.207958-1-eblake@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-03-09Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20210307' ↵Peter Maydell
into staging qemu-sparc queue # gpg: Signature made Sun 07 Mar 2021 12:07:13 GMT # gpg: using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F # gpg: issuer "mark.cave-ayland@ilande.co.uk" # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full] # Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F * remotes/mcayland/tags/qemu-sparc-20210307: (42 commits) esp: add support for unaligned accesses esp: implement non-DMA transfers in PDMA mode esp: add trivial implementation of the ESP_RFLAGS register esp: convert cmdbuf from array to Fifo8 esp: convert ti_buf from array to Fifo8 esp: transition to message out phase after SATN and stop command esp: add maxlen parameter to get_cmd() esp: raise interrupt after every non-DMA byte transferred to the FIFO esp: remove old deferred command completion mechanism esp: defer command completion interrupt on incoming data transfers esp: latch individual bits in ESP_RINTR register esp: implement FIFO flush command esp: add 4 byte PDMA read and write transfers esp: remove pdma_origin from ESPState esp: use FIFO for PDMA transfers between initiator and device esp: fix PDMA target selection esp: rename get_cmd_cb() to esp_select() esp: remove CMD pdma_origin esp: use in-built TC to determine PDMA transfer length esp: use ti_wptr/ti_rptr to manage the current FIFO position for PDMA ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-07esp: add support for unaligned accessesMark Cave-Ayland
When the MacOS toolbox ROM transfers data from a target device to an unaligned memory address, the first/last byte of a 16-bit transfer needs to be handled separately. This means that the first byte is preloaded into the FIFO before the transfer, or the last byte remains in the FIFO after the transfer. The result of this is that the PDMA routines must be updated so that the FIFO is loaded/unloaded if the last 16-bit word is used (rather than the last byte) and any remaining byte from a FIFO wraparound is handled correctly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-43-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: implement non-DMA transfers in PDMA modeMark Cave-Ayland
The MacOS toolbox ROM uses non-DMA TI commands to handle the first/last byte of an unaligned 16-bit transfer to memory. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-42-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: add trivial implementation of the ESP_RFLAGS registerMark Cave-Ayland
The bottom 5 bits contain the number of bytes remaining in the FIFO which is trivial to implement with Fifo8 (the remaining bits are unimplemented and left as 0 for now). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-41-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: convert cmdbuf from array to Fifo8Mark Cave-Ayland
Rename ESP_CMDBUF_SZ to ESP_CMDFIFO_SZ and cmdbuf_cdb_offset to cmdfifo_cdb_offset to indicate that the command buffer type has changed from an array to a Fifo8. This also enables us to remove the ESPState field cmdlen since the command length is now simply the number of elements used in cmdfifo. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-40-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: convert ti_buf from array to Fifo8Mark Cave-Ayland
Rename TI_BUFSZ to ESP_FIFO_SZ since this constant is really describing the size of the FIFO and is not directly related to the TI size. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-39-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: transition to message out phase after SATN and stop commandMark Cave-Ayland
The SCSI bus should remain in the message out phase after the SATN and stop command rather than transitioning to the command phase. A new ESPState variable cmdbuf_cdb_offset is added which stores the offset of the CDB from the start of cmdbuf when accumulating extended message out phase data. Currently any extended message out data is discarded in do_cmd() before the CDB is processed in do_busid_cmd(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-38-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: add maxlen parameter to get_cmd()Mark Cave-Ayland
Some guests use a mixture of DMA and non-DMA transfers in combination with the SATN and stop command to transfer message out phase and command phase bytes to the target. Prepare for the next commit by adding a maxlen parameter to get_cmd() to allow partial transfers. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-37-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: raise interrupt after every non-DMA byte transferred to the FIFOMark Cave-Ayland
This matches the description in the datasheet and is required as support for non-DMA transfers is added. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-36-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove old deferred command completion mechanismMark Cave-Ayland
Commit ea84a44250 "scsi: esp: Defer command completion until previous interrupts have been handled" provided a mechanism to delay the command completion interrupt until ESP_RINTR is read after the command has completed. With the previous fixes for latching the ESP_RINTR bits and deferring the setting of the command completion interrupt for incoming data to the SCSI callback, this workaround is no longer required and can be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-35-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: defer command completion interrupt on incoming data transfersMark Cave-Ayland
The MacOS toolbox ROM issues a command to the ESP controller as part of its "FAST" SCSI routines and then proceeds to read the incoming data soon after receiving the command completion interrupt. Unfortunately due to SCSI block transfers being asynchronous the incoming data may not yet be present causing an underflow error. Resolve this by waiting for the SCSI subsystem transfer_data callback before raising the command completion interrupt. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-34-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: latch individual bits in ESP_RINTR registerMark Cave-Ayland
Currently the ESP_RINTR register is set to a specific value as required within the ESP state machine. In order to implement the upcoming deferred interrupt functionality it is necessary to set individual bits within ESP_RINTR so that a deferred interrupt will not overwrite the value of any other interrupt bits. This also requires fixing up a few locations where the ESP_RINTR and ESP_RSEQ registers are set/reset unexpectedly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-33-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: implement FIFO flush commandMark Cave-Ayland
At this point it is now possible to properly implement the FIFO flush command without causing guest errors. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-32-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: add 4 byte PDMA read and write transfersMark Cave-Ayland
The MacOS toolbox ROM performs 4 byte reads/writes when transferring data to and from the target. Since the SCSI bus is 16-bits wide, use the memory API to split a 4 byte access into 2 x 2 byte accesses. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-31-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove pdma_origin from ESPStateMark Cave-Ayland
Now that all data is transferred via the FIFO (ti_buf) there is no need to track the source buffer being used for the data transfer. This also eliminates the need for a separate subsection for PDMA state migration. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-30-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: use FIFO for PDMA transfers between initiator and deviceMark Cave-Ayland
PDMA as implemented on the Quadra 800 uses DREQ to load data into the FIFO up to a maximum of 16 bytes at a time. The MacOS toolbox ROM requires this because it mixes FIFO and PDMA transfers whilst checking the FIFO status and counter registers to ensure success. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-29-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: fix PDMA target selectionMark Cave-Ayland
Currently the target selection for PDMA is done after the SCSI command has been delivered which is not correct. Perform target selection as part of the initial get_cmd() call when the command is submitted: if no target is present, don't raise DRQ. If the target is present then switch to the command phase since the MacOS toolbox ROM checks for this before attempting to submit the SCSI command. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-28-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: rename get_cmd_cb() to esp_select()Mark Cave-Ayland
This better describes the purpose of the function. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-27-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove CMD pdma_originMark Cave-Ayland
The cmdbuf is really just a copy of FIFO data (including extra message phase bytes) so its pdma_origin is effectively TI. Fortunately we already know when we are receiving a SCSI command since do_cmd == 1 which enables us to distinguish between the two cases in esp_pdma_read()/esp_pdma_write(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-26-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: use in-built TC to determine PDMA transfer lengthMark Cave-Ayland
Real hardware simply counts down using the in-built TC to determine when the the PDMA request is complete. Use the TC to determine the PDMA transfer length which then enables us to remove the redundant pdma_len variable. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-25-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: use ti_wptr/ti_rptr to manage the current FIFO position for PDMAMark Cave-Ayland
This eliminates the last user of the PDMA-specific pdma_cur variable which can now be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-24-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: move PDMA length adjustments into esp_pdma_read()/esp_pdma_write()Mark Cave-Ayland
Here the updates to async_len and ti_size are moved into the corresponding esp_pdma_read()/esp_pdma_write() function to eliminate the reference to pdma_cur in do_dma_pdma_cb(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-23-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove redundant pdma_start from ESPStateMark Cave-Ayland
Now that PDMA SCSI commands are accumulated in cmdbuf in the same way as normal commands, the existing logic for locating the start of the SCSI command in cmdbuf via cmdlen can be used. This enables the PDMA-specific pdma_start and also get_pdma_buf() to be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-22-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove the buf and buflen parameters from get_cmd()Mark Cave-Ayland
Now that all SCSI commands are accumulated in cmdbuf, remove the buf and buflen parameters from get_cmd() since these always reference cmdbuf and ESP_CMDBUF_SZ respectively. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-21-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove buf parameter from do_cmd()Mark Cave-Ayland
Now that all SCSI commands are accumulated in cmdbuf, remove the buf parameter from do_cmd() since this always points to cmdbuf. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-20-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: accumulate SCSI commands for PDMA transfers in cmdbuf instead of pdma_bufMark Cave-Ayland
ESP SCSI commands are already accumulated in cmdbuf and so there is no need to keep a separate pdma_buf buffer. Accumulate SCSI commands for PDMA transfers in cmdbuf instead of pdma_buf so update cmdlen accordingly and change pdma_origin for PDMA transfers to CMD which allows the PDMA origin to be removed. This commit also removes a stray memcpy() from get_cmd() which is a no-op because cmdlen is always zero at the start of a command. Notionally the removal of pdma_buf from vmstate_esp_pdma also breaks migration compatibility for the PDMA subsection until its complete removal by the end of the series. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-19-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: move pdma_len and TC logic into esp_pdma_read()/esp_pdma_write()Mark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-18-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: use pdma_origin directly in esp_pdma_read()/esp_pdma_write()Mark Cave-Ayland
This is the first step in removing get_pdma_buf() from esp.c. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-17-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: introduce esp_pdma_read() and esp_pdma_write() functionsMark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-16-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove minlen restriction in handle_tiMark Cave-Ayland
The limiting of DMA transfers to the maximum size of the available data is already handled by esp_do_dma() and do_dma_pdma_cb(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-15-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove dma_left from ESPStateMark Cave-Ayland
The ESP device already keeps track of the remaining bytes left to transfer via its TC (transfer counter) register which is decremented for each byte that is transferred across the SCSI bus. Switch the transfer logic to use the value of TC instead of dma_left and then remove dma_left completely, adding logic to the vmstate_esp post_load() function to transfer the old dma_left value to the TC register during migration from older versions. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-14-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: remove dma_counter from ESPStateMark Cave-Ayland
The value of dma_counter is set once at the start of the transfer and remains the same until the transfer is complete. This allows the check in esp_transfer_data to be simplified since dma_left will always be non-zero until the transfer is completed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-13-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: apply transfer length adjustment when STC is zero at TC load timeMark Cave-Ayland
Perform the length adjustment whereby a value of 0 in the STC represents a transfer length of 0x10000 at the point where the TC is loaded at the start of a DMA command rather than just when a TI (Transfer Information) command is executed. This better matches the description as given in the datasheet. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-12-mark.cave-ayland@ilande.co.uk>
2021-03-07esp: introduce esp_get_stc()Mark Cave-Ayland
This function simplifies reading the STC register value without having to manually shift each individual 8-bit value. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210304221103.6369-11-mark.cave-ayland@ilande.co.uk>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-28 05:32:49 +0000