Commit Graph

85292 Commits

Author SHA1 Message Date
Daniel Henrique Barboza
fe1831eff8 spapr_drc.c: use DRC reconfiguration to cleanup DIMM unplug state
Handling errors in memory hotunplug in the pSeries machine is more
complex than any other device type, because there are all the
complications that other devices has, and more.

For instance, determining a timeout for a DIMM hotunplug must consider
if it's a Hash-MMU or a Radix-MMU guest, because Hash guests takes
longer to hotunplug DIMMs. The size of the DIMM is also a factor, given
that longer DIMMs naturally takes longer to be hotunplugged from the
kernel. And there's also the guest memory usage to be considered: if
there's a process that is consuming memory that would be lost by the
DIMM unplug, the kernel will postpone the unplug process until the
process finishes, and then initiate the regular hotunplug process. The
first two considerations are manageable, but the last one is a deal
breaker.

There is no sane way for the pSeries machine to determine the memory
load in the guest when attempting a DIMM hotunplug - and even if there
was a way, the guest can start using all the RAM in the middle of the
unplug process and invalidate our previous assumptions - and in result
we can't even begin to calculate a timeout for the operation. This means
that we can't implement a viable timeout mechanism for memory unplug in
pSeries.

Going back to why we would consider an unplug timeout, the reason is
that we can't know if the kernel is giving up the unplug. Turns out
that, sometimes, we can. Consider a failed memory hotunplug attempt
where the kernel will error out with the following message:

'pseries-hotplug-mem: Memory indexed-count-remove failed, adding any
removed LMBs'

This happens when there is a LMB that the kernel gave up in removing,
and the LMBs previously marked for removal are now being added back.
This happens in the pseries kernel in [1], dlpar_memory_remove_by_ic()
into dlpar_add_lmb(), and after that update_lmb_associativity_index().
In this function, the kernel is configuring the LMB DRC connector again.
Note that this is a valid usage in LOPAR, as stated in section
"ibm,configure-connector RTAS Call":

'A subsequent sequence of calls to ibm,configure-connector with the same
entry from the “ibm,drc-indexes” or “ibm,drc-info” property will restart
the configuration of devices which were not completely configured.'

We can use this kernel behavior in our favor. If a DRC connector
reconfiguration for a LMB that we marked as unplug pending happens, this
indicates that the kernel changed its mind about the unplug and is
reasserting that it will keep using all the LMBs of the DIMM. In this
case, it's safe to assume that the whole DIMM device unplug was
cancelled.

This patch hops into rtas_ibm_configure_connector() and, in the scenario
described above, clear the unplug state for the DIMM device. This will
not solve all the problems we still have with memory unplug, but it will
cover this case where the kernel reconfigures LMBs after a failed
unplug. We are a bit more resilient, without using an unreliable
timeout, and we didn't make the remaining error cases any worse.

[1] arch/powerpc/platforms/pseries/hotplug-memory.c

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20210222194531.62717-6-danielhb413@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:09 +11:00
Daniel Henrique Barboza
d1c2e3ce3d spapr_drc.c: add hotunplug timeout for CPUs
There is a reliable way to make a CPU hotunplug fail in the pseries
machine. Hotplug a CPU A, then offline all other CPUs inside the guest
but A. When trying to hotunplug A the guest kernel will refuse to do it,
because A is now the last online CPU of the guest. PAPR has no 'error
callback' in this situation to report back to the platform, so the guest
kernel will deny the unplug in silent and QEMU will never know what
happened. The unplug pending state of A will remain until the guest is
shutdown or rebooted.

Previous attempts of fixing it (see [1] and [2]) were aimed at trying to
mitigate the effects of the problem. In [1] we were trying to guess
which guest CPUs were online to forbid hotunplug of the last online CPU
in the QEMU layer, avoiding the scenario described above because QEMU is
now failing in behalf of the guest. This is not robust because the last
online CPU of the guest can change while we're in the middle of the
unplug process, and our initial assumptions are now invalid. In [2] we
were accepting that our unplug process is uncertain and the user should
be allowed to spam the IRQ hotunplug queue of the guest in case the CPU
hotunplug fails.

This patch presents another alternative, using the timeout
infrastructure introduced in the previous patch. CPU hotunplugs in the
pSeries machine will now timeout after 15 seconds. This is a long time
for a single CPU unplug to occur, regardless of guest load - although
the user is *strongly* encouraged to *not* hotunplug devices from a
guest under high load - and we can be sure that something went wrong if
it takes longer than that for the guest to release the CPU (the same
can't be said about memory hotunplug - more on that in the next patch).

Timing out the unplug operation will reset the unplug state of the CPU
and allow the user to try it again, regardless of the error situation
that prevented the hotunplug to occur. Of all the not so pretty
fixes/mitigations for CPU hotunplug errors in pSeries, timing out the
operation is an admission that we have no control in the process, and
must assume the worst case if the operation doesn't succeed in a
sensible time frame.

[1] https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg03353.html
[2] https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg04400.html

Reported-by: Xujun Ma <xuma@redhat.com>
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1911414
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20210222194531.62717-5-danielhb413@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:09 +11:00
Daniel Henrique Barboza
51254ffb32 spapr_drc.c: introduce unplug_timeout_timer
The LoPAR spec provides no way for the guest kernel to report failure of
hotplug/hotunplug events. This wouldn't be bad if those operations were
granted to always succeed, but that's far for the reality.

What ends up happening is that, in the case of a failed hotunplug,
regardless of whether it was a QEMU error or a guest misbehavior, the
pSeries machine is retaining the unplug state of the device in the
running guest.  This state is cleanup in machine reset, where it is
assumed that this state represents a device that is pending unplug, and
the device is hotunpluged from the board. Until the reset occurs, any
hotunplug operation of the same device is forbid because there is a
pending unplug state.

This behavior has at least one undesirable side effect. A long standing
pending unplug state is, more often than not, the result of a hotunplug
error. The user had to dealt with it, since retrying to unplug the
device is noy allowed, and then in the machine reset we're removing the
device from the guest. This means that we're failing the user twice -
failed to hotunplug when asked, then hotunplugged without notice.

Solutions to this problem range between trying to predict when the
hotunplug will fail and forbid the operation from the QEMU layer, from
opening up the IRQ queue to allow for multiple hotunplug attempts, from
telling the users to 'reboot the machine if something goes wrong'. The
first solution is flawed because we can't fully predict guest behavior
from QEMU, the second solution is a trial and error remediation that
counts on a hope that the unplug will eventually succeed, and the third
is ... well.

This patch introduces a crude, but effective solution to hotunplug
errors in the pSeries machine. For each unplug done, we'll timeout after
some time. If a certain amount of time passes, we'll cleanup the
hotunplug state from the machine.  During the timeout period, any unplug
operations in the same device will still be blocked. After that, we'll
assume that the guest failed the operation, and allow the user to try
again. If the timeout is too short we'll prevent legitimate hotunplug
situations to occur, so we'll need to overestimate the regular time an
unplug operation takes to succeed to account that.

The true solution for the hotunplug errors in the pSeries machines is a
PAPR change to allow for the guest to warn the platform about it. For
now, the work done in this timeout design can be used for the new PAPR
'abort hcall' in the future, given that for both cases we'll need code
to cleanup the existing unplug states of the DRCs.

At this moment we're adding the basic wiring of the timer into the DRC.
Next patch will use the timer to timeout failed CPU hotunplugs.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20210222194531.62717-4-danielhb413@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:09 +11:00
Fabiano Rosas
936fda4d77 target/ppc: Fix bcdsub. emulation when result overflows
The commit d03b174a83 (target/ppc: simplify bcdadd/sub functions)
meant to simplify some of the code but it inadvertently altered the
way the CR6 field is set after the operation has overflowed.

The CR6 bits are set based on the *unbounded* result of the operation,
so we need to look at the result before returning from bcd_add_mag,
otherwise we will look at 0 when it overflows.

Consider the following subtraction:

v0 = 0x9999999999999999999999999999999c (maximum positive BCD value)
v1 = 0x0000000000000000000000000000001d (negative one BCD value)
bcdsub. v0,v0,v1,0

The Power ISA 2.07B says:
If the unbounded result is greater than zero, do the following.
  If PS=0, the sign code of the result is set to 0b1100.
  If PS=1, the sign code of the result is set to 0b1111.
  If the operation overflows, CR field 6 is set to 0b0101. Otherwise,
  CR field 6 is set to 0b0100.

POWER9 hardware:
vr0 = 0x0000000000000000000000000000000c (positive zero BCD value)
cr6 = 0b0101 (0x5) (positive, overflow)

QEMU:
vr0 = 0x0000000000000000000000000000000c (positive zero BCD value)
cr6 = 0b0011 (0x3) (zero, overflow) <--- wrong

This patch reverts the part of d03b174a83 that introduced the
problem and adds a test-case to avoid further regressions:

before:
$ make run-tcg-tests-ppc64le-linux-user
(...)
  TEST    bcdsub on ppc64le
bcdsub: qemu/tests/tcg/ppc64le/bcdsub.c:58: test_bcdsub_gt:
Assertion `(cr >> 4) == ((1 << 2) | (1 << 0))' failed.

Fixes: d03b174a83 (target/ppc: simplify bcdadd/sub functions)
Reported-by: Paul Clarke <pc@us.ibm.com>
Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
Message-Id: <20210222194035.2723056-1-farosas@linux.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:09 +11:00
Cédric Le Goater
a4ee352fe0 docs/system: Extend PPC section
This moves the current documentation in files specific to each
platform family. PowerNV machine is updated, the other machines need
to be done.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20210222133956.156001-1-clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
[dwg: Trivial capitalization fix]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:09 +11:00
Daniel Henrique Barboza
a03509cd2b spapr: rename spapr_drc_detach() to spapr_drc_unplug_request()
spapr_drc_detach() is not the best name for what the function does. The
function does not detach the DRC, it makes an uncommited attempt to do
it.  It'll mark the DRC as pending unplug, via the 'unplug_request'
flag, and only if the DRC state is drck->empty_state it will detach the
DRC, via spapr_drc_release().

This is a contrast with its pair spapr_drc_attach(), where the function
is indeed creating the DRC QOM object. If you know what
spapr_drc_attach() does, you can be misled into thinking that
spapr_drc_detach() is removing the DRC from QEMU internal state, which
isn't true.

The current role of this function is better described as a request for
detach, since there's no guarantee that we're going to detach the DRC in
the end.  Rename the function to spapr_drc_unplug_request to reflect
what is is doing.

The initial idea was to change the name to spapr_drc_detach_request(),
and later on change the unplug_request flag to detach_request. However,
unplug_request is a migratable boolean for a long time now and renaming
it is not worth the trouble. spapr_drc_unplug_request() setting
drc->unplug_request is more natural than spapr_drc_detach_request
setting drc->unplug_request.

Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20210222194531.62717-3-danielhb413@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:08 +11:00
Daniel Henrique Barboza
66d10d32ac spapr_drc.c: use spapr_drc_release() in isolate_physical/set_unusable
When moving a physical DRC to "Available", drc_isolate_physical() will
move the DRC state to STATE_PHYSICAL_POWERON and, if the DRC is marked
for unplug, call spapr_drc_detach(). For physical DRCs,
drck->empty_state is STATE_PHYSICAL_POWERON, meaning that we're sure
that spapr_drc_detach() will end up calling spapr_drc_release() in the
end.

Likewise, for logical DRCs, drc_set_unusable will move the DRC to
"Unusable" state, setting drc->state to STATE_LOGICAL_UNUSABLE, which is
the drck->empty_state for logical DRCs. spapr_drc_detach() will call
spapr_drc_release() in this case as well.

In both scenarios, spapr_drc_detach() is being used as a
spapr_drc_release(), wrapper, where we also set unplug_requested (which
is already true, otherwise spapr_drc_detach() wouldn't be called in the
first place) and check if drc->state == drck->empty_state, which we also
know it's guaranteed to be true because we just set it.

Just use spapr_drc_release() in these functions to be clear of our
intentions in both these functions.

Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20210222194531.62717-2-danielhb413@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:08 +11:00
Alexey Kardashevskiy
b88e0a57e6 pseries: Update SLOF firmware image
This is mostly compiler warnings fixed but while doing this,
a bug in MIN() in tcgbios was found.

Alexey Kardashevskiy (14):
      helpers: Define MIN()
      libc: Compile with -Wextra
      elf: Compile with -Wextra
      usb: Compile with -Wextra
      veth: Compile with -Wextra
      virtio: Compile with -Wextra
      e1000: Compile with -Wextra
      libnet: Compile with -Wextra
      libhv: Compile with -Wextra
      libnvram: Compile with -Wextra
      libtpm: Compile with -Wextra
      slof/prim: Compile with -Wextra
      Makefile: Actually compile with -Wextra
      version: update to 20210217

Thomas Huth (1):
      virtio-serial: Remove superfluous serial-* words

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:08 +11:00
Daniel Henrique Barboza
382907b100 spapr_drc.c: do not call spapr_drc_detach() in drc_isolate_logical()
drc_isolate_logical() is used to move the DRC from the "Configured" to
the "Available" state, erroring out if the DRC is in the unexpected
"Unisolate" state and doing nothing (with RTAS_OUT_SUCCESS) if the DRC
is already in "Available" or in "Unusable" state.

When moving from "Configured" to "Available", the DRC is moved to the
LOGICAL_AVAILABLE state, a drc->unplug_requested check is done and, if
true, spapr_drc_detach() is called.

What spapr_drc_detach() does then is:

- set drc->unplug_requested to true. In fact, this is the only place
where unplug_request is set to true;
- does nothing else if drc->state != drck->empty_state. If the DRC
state is equal to drck->empty_state, spapr_drc_release() is
called. For logical DRCs, drck->empty_state = LOGICAL_UNUSABLE.

In short, calling spapr_drc_detach() in drc_isolate_logical() does
nothing. It'll set unplug_request to true again ('again' since it was
already true - otherwise the function wouldn't be called), and will
return without calling spapr_drc_release() because the DRC is not in
LOGICAL_UNUSABLE, since drc_isolate_logical() just moved it to
LOGICAL_AVAILABLE. The only place where the logical DRC is released is
when called from drc_set_unusable(), when it is moved to the
"Unusable" state.  As it should, according to PAPR.

Even though calling spapr_drc_detach() in drc_isolate_logical() is
benign, removing it will avoid further thought about the matter. So
let's go ahead and do that.

As a note, this logic was introduced in commit bbf5c878ab. Since
then, the DRC handling code was refactored and enhanced, and PAPR
itself went through some changes in the DRC area as well. It is
expected that some assumptions we had back then are now deprecated.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20210211225246.17315-2-danielhb413@gmail.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:08 +11:00
Peter Maydell
f7b5c16182 hw/display/sm501: Inline template header into C file
We no longer need to include sm501_template.h multiple times, so
we can simply inline its contents into sm501.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20210212180653.27588-4-peter.maydell@linaro.org>
Acked-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:08 +11:00
Peter Maydell
36144df315 hw/display/sm501: Expand out macros in template header
Now that we only include sm501_template.h for the DEPTH==32 case, we
can expand out the uses of the BPP, PIXEL_TYPE and PIXEL_NAME macros
in that header.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20210212180653.27588-3-peter.maydell@linaro.org>
Acked-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:08 +11:00
Peter Maydell
ec79c56300 hw/display/sm501: Remove dead code for non-32-bit RGB surfaces
For a long time now the UI layer has guaranteed that the console
surface is always 32 bits per pixel RGB. Remove the legacy dead
code from the sm501 display device which was handling the
possibility that the console surface was some other format.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20210212180653.27588-2-peter.maydell@linaro.org>
Acked-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-10 09:07:08 +11:00
Peter Maydell
b2ae1009d7 qemu-sparc queue
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCgA8FiEEzGIauY6CIA2RXMnEW8LFb64PMh8FAmBEwfEeHG1hcmsuY2F2
 ZS1heWxhbmRAaWxhbmRlLmNvLnVrAAoJEFvCxW+uDzIfYZYH/AwOuqycV9XI1s3K
 valsExtSmcj6oTrFTSyak0U7QL9G5pm40qEHwQkwFwYecaQXfFNMN1Mt4gYpsLai
 JNhV29tzWrQtNFepCjvvuJihDY5IC/3NWyrWqYXRNZ5IGMvde3HUcg210bFOC3mf
 iOtZ40ZjBspTwG4eJCOLBBDeXVAMkVUjdfqtsq66zGteHsJjNEpso0HLdMvlFkud
 QLF4g06h8iFMxwahZYEwY+fKUHphqfZn8INr01ODQIy3nBGVgenKz9DKPw/pg/UD
 nfxhuYwftDof65JpYEhClOWas3AztFJ1YyyP/cibwosLBQVphj3R05/kF6VuyuyP
 gZjux0w=
 =RPt3
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20210307' into staging

qemu-sparc queue

# gpg: Signature made Sun 07 Mar 2021 12:07:13 GMT
# gpg:                using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F
# gpg:                issuer "mark.cave-ayland@ilande.co.uk"
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full]
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* remotes/mcayland/tags/qemu-sparc-20210307: (42 commits)
  esp: add support for unaligned accesses
  esp: implement non-DMA transfers in PDMA mode
  esp: add trivial implementation of the ESP_RFLAGS register
  esp: convert cmdbuf from array to Fifo8
  esp: convert ti_buf from array to Fifo8
  esp: transition to message out phase after SATN and stop command
  esp: add maxlen parameter to get_cmd()
  esp: raise interrupt after every non-DMA byte transferred to the FIFO
  esp: remove old deferred command completion mechanism
  esp: defer command completion interrupt on incoming data transfers
  esp: latch individual bits in ESP_RINTR register
  esp: implement FIFO flush command
  esp: add 4 byte PDMA read and write transfers
  esp: remove pdma_origin from ESPState
  esp: use FIFO for PDMA transfers between initiator and device
  esp: fix PDMA target selection
  esp: rename get_cmd_cb() to esp_select()
  esp: remove CMD pdma_origin
  esp: use in-built TC to determine PDMA transfer length
  esp: use ti_wptr/ti_rptr to manage the current FIFO position for PDMA
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-09 13:50:35 +00:00
Peter Maydell
bb5643ff61 Add hexagon to include/exec/poison.h
Two Coverity fixes for target/hexagon/
 -----BEGIN PGP SIGNATURE-----
 
 iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmBELkEdHHJpY2hhcmQu
 aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV/m3AgArXfk3YzPFzfOPTpl
 metOUVJvfcHIRCgUpwF/eHySuUW7Iq8YVQBxUQiwnEYQY+AaE3esuS9A/K3C3rzg
 GTFwgxhhiGPujk/QvDklJr40rSyXd8BAY5LchqsTiz458UylXRUCzFrRZlLdsnxC
 1KlVeU9zk7LhZtr7yv6UZMeuedTiAECgfJWf6q5Gj/izySKzjt0HzkV3jGdkIZyh
 8EyS5GtyJg49YwYGw8yYvpgCktwBlcOMXBjwdD20tvyO/IDdsmKGqe7Lq93c7L6u
 ul7ZwV3wcEbXvKhtvlvosjjomvYhGGuJh0irTVL0yhfnQn9ppx0X4JhjJyNPwErD
 YvFl1Q==
 =YbMU
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-hex-20210306' into staging

Add hexagon to include/exec/poison.h
Two Coverity fixes for target/hexagon/

# gpg: Signature made Sun 07 Mar 2021 01:37:05 GMT
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth-gitlab/tags/pull-hex-20210306:
  target/hexagon/opcodes: Add missing varargs cleanup
  target/hexagon: Fix shift amount check in fASHIFTL/fLSHIFTR
  exec: Poison Hexagon target-specific definitions

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-09 11:22:18 +00:00
Peter Maydell
74fd46ed44 TCI build fix and cleanup
Streamline tb_lookup
 Fixes for tcg/aarch64
 -----BEGIN PGP SIGNATURE-----
 
 iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmBD9XYdHHJpY2hhcmQu
 aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV9jqwf/cIr0aafPuLyMwAFB
 WCL2+S7oZT8n9dXTwel9MTjnLg4tApvHcxwdNMeCnWIvJ2wtLg4NHsOv+mitWTpD
 D1AMgVRvEaLYFFMa582ewopLee1Yp0vTWYtVwXIRMFW2qJv4b6h/cEJae3DjbFLs
 TlU6XBlPjNLjWECCO+cxVUJRojLpf0WuJrn7REALYdiAAK/+X7g3wwfxc4VP0D6a
 NO54gLH2XSVDosWn0vJu5czDGTA3ZD7mLRuFscyVsK7KKx2xgZq2WzcMATeKo5Qy
 qn/E2bYn2nMEv78ptt3h06sSwGs0W41a68Y7uqWIkdfI1aGeIBzFn2rmXoXaaAfd
 IrJnLQ==
 =f77X
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210306' into staging

TCI build fix and cleanup
Streamline tb_lookup
Fixes for tcg/aarch64

# gpg: Signature made Sat 06 Mar 2021 21:34:46 GMT
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth-gitlab/tags/pull-tcg-20210306: (27 commits)
  accel/tcg: Precompute curr_cflags into cpu->tcg_cflags
  include/exec: lightly re-arrange TranslationBlock
  accel/tcg: drop the use of CF_HASH_MASK and rename params
  accel/tcg: move CF_CLUSTER calculation to curr_cflags
  accel/tcg: rename tb_lookup__cpu_state and hoist state extraction
  tcg/tci: Merge mov, not and neg operations
  tcg/tci: Merge bswap operations
  tcg/tci: Merge extension operations
  tcg/tci: Merge basic arithmetic operations
  tcg/tci: Reduce use of tci_read_r64
  tcg/tci: Remove tci_read_r32s
  tcg/tci: Remove tci_read_r32
  tcg/tci: Remove tci_read_r16s
  tcg/tci: Remove tci_read_r16
  tcg/tci: Remove tci_read_r8s
  tcg/tci: Remove tci_read_r8
  tcg/tci: Merge identical cases in generation (load/store opcodes)
  tcg/tci: Merge identical cases in generation (conditional opcodes)
  tcg/tci: Merge identical cases in generation (deposit opcode)
  tcg/tci: Merge identical cases in generation (exchange opcodes)
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-08 20:07:37 +00:00
Peter Maydell
229a834518 Renesas patches queue
- MMU prototype cleanups
 - Clarify licenses
 - Fine-grained Kconfig entries for SH-4 devices
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmBDoCYACgkQ4+MsLN6t
 wN415Q/+PB2dSMspfBe5M93GcYFQlNH5Eqq23hAJ8p6PIddw+4/ESl6xZ0iobQfN
 DfcP+LBPiDXdtfk3hLkgdzgMkxPfPBbkeYrRl7mYs0BzdJXEP39mUxxaDoOehxba
 1uzk2+4Ce5Wa4ge3P8ozAeS/ZRfv1RZkrbvywVPcXemI5iHvYic/P9P1eF3cobak
 u+FMO+1Zij+FEhK2uiDT+D5RikFFA0XstsJkr3rmmbRCQ+Gi+8mDOEy9iz/pR3rR
 uh27mcuSsc6IftFUWlxFWl/64mjS1CTuCPZijgJarqH68ktBOanR56/SyjNBBd7f
 axcGloaXaaWpGBvYI5ssOJDusg89tmC9mSbrxBbEwxOdcpFgaQWnxVLZVAE55p+e
 6JXJLNnNYHNe58BOTaAzhRGv8vOykHpY69yLkWBgGkwAUH3E8I1O3JWjD/7yDuaX
 FcwAIT+NneUs+wXyFivbDIiLos8Edv4x713PlEEGubUP9U5rkmYGRLJiH28DL3gz
 /3XvLwd20nK0qjCJ5zgZ5V3ZqfXJmLrkaWbA95swLlzZvQ7GR3lefyc+0h0+Bsk6
 3C+3EZOK5SM+uSzt3R98JvuJ0j3U9TJ+7v2DuM4hpGuQot0W5wn3SIC0geCk4LJz
 3BlQpxTzRVzJgwffLa+SayFQUbv713rofp3eK+izGUrzG8b/dq0=
 =+iNP
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/philmd-gitlab/tags/renesas-20210306' into staging

Renesas patches queue

- MMU prototype cleanups
- Clarify licenses
- Fine-grained Kconfig entries for SH-4 devices

# gpg: Signature made Sat 06 Mar 2021 15:30:46 GMT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* remotes/philmd-gitlab/tags/renesas-20210306:
  hw/sh4/sh7750_regs: Replace link to license by its full content
  hw/sh4: Remove now unused CONFIG_SH4 from Kconfig
  hw/pci-host: Introduce SH_PCI Kconfig entry
  hw/block: Introduce TC58128 eeprom Kconfig entry
  hw/timer: Introduce SH_TIMER Kconfig entry
  hw/char: Introduce SH_SCI Kconfig entry
  hw/intc: Introduce SH_INTC Kconfig entry
  hw/sh4: Add missing Kconfig dependency on SH7750 for the R2D board
  hw/sh4: Add missing license
  target/sh4: Remove unused definitions
  target/sh4: Let get_physical_address() use MMUAccessType access_type
  target/sh4: Remove unused 'int access_type' argument
  target/sh4: Replace magic value by MMUAccessType definitions
  target/sh4: Fix code style for checkpatch.pl

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-08 15:45:48 +00:00
Peter Maydell
0436c55edf * fix tracing vs -daemonize (Daniel)
* detect invalid CFI configuration (Daniele)
 * 32-bit PVH fix (David)
 * forward SCSI passthrough host-status to the SCSI HBA (Hannes)
 * detect ill-formed id in QMP object-add (Kevin)
 * miscellaneous bugfixes and cleanups (Keqian, Kostiantyn, myself, Peng Liang)
 * add nodelay option for chardev (myself)
 * deprecate -M kernel-irqchip=off on x86 (myself)
 * keep .d files (myself)
 * Fix -trace file (myself)
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmBDXMAUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroPYPwf/YeM8TYqCFCt3Th4Ap2IuMqI/7HRq
 iNFlKWfM2S7Gk87RaNINL96MHadOteeYSQLuh4Y6FHL1OGpWX2ZByXR//z2DARLC
 AuV1IncevVyQiSDQzwZj6BU7G4b8xSU3Ey5yseYv+hjUhVbiscDvpioV2USkUvD5
 IJFXwL5+eRAOGma0SAcumgwu5xc5/GGh5D63vZ0R7q5eDCu69Q6/ZYvK93b6+TP7
 GWboGJFcbTvYku56S4ip8VdEzxiNhfQgGNa3nNDx4ejiTt4mYAft7wy+j/iQjPW9
 P0y4AYuvInCrUy1RBR1BqAE+ZXNxqby3AQ0ZTujG+YMiWLIvz5FZtGEvyg==
 =aCET
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging

* fix tracing vs -daemonize (Daniel)
* detect invalid CFI configuration (Daniele)
* 32-bit PVH fix (David)
* forward SCSI passthrough host-status to the SCSI HBA (Hannes)
* detect ill-formed id in QMP object-add (Kevin)
* miscellaneous bugfixes and cleanups (Keqian, Kostiantyn, myself, Peng Liang)
* add nodelay option for chardev (myself)
* deprecate -M kernel-irqchip=off on x86 (myself)
* keep .d files (myself)
* Fix -trace file (myself)

# gpg: Signature made Sat 06 Mar 2021 10:43:12 GMT
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini-gitlab/tags/for-upstream: (23 commits)
  meson: Stop if cfi is enabled with system slirp
  trace: skip qemu_set_log_filename if no "-D" option was passed
  trace: fix "-trace file=..."
  meson: adjust timeouts for some slower tests
  build-sys: invoke ninja with -d keepdepfile
  qemu-option: do not suggest using the delay option
  scsi: move host_status handling into SCSI drivers
  scsi: inline sg_io_sense_from_errno() into the callers.
  scsi-generic: do not snoop the output of failed commands
  scsi: Add mapping for generic SCSI_HOST status to sense codes
  scsi: Rename linux-specific SG_ERR codes to generic SCSI_HOST error codes
  qemu-config: add error propagation to qemu_config_parse
  x86/pvh: extract only 4 bytes of start address for 32 bit kernels
  elf_ops: correct loading of 32 bit PVH kernel
  lsilogic: Use PCIDevice::exit instead of DeviceState::unrealize
  accel: kvm: Add aligment assert for kvm_log_clear_one_slot
  accel: kvm: Fix memory waste under mismatch page size
  vl.c: do not execute trace_init_backends() before daemonizing
  qom: Check for wellformed id in user_creatable_add_type()
  chardev: add nodelay option
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-08 13:51:41 +00:00
Peter Maydell
138d293197 target-arm queue:
* sbsa-ref: remove cortex-a53 from list of supported cpus
  * sbsa-ref: add 'max' to list of allowed cpus
  * target/arm: Add support for FEAT_SSBS, Speculative Store Bypass Safe
  * npcm7xx: add EMC model
  * xlnx-zynqmp: Remove obsolete 'has_rpu' property
  * target/arm: Speed up aarch64 TBL/TBX
  * virtio-mmio: improve virtio-mmio get_dev_path alog
  * target/arm: Use TCF0 and TFSRE0 for unprivileged tag checks
  * target/arm: Restrict v8M IDAU to TCG
  * target/arm/cpu: Update coding style to make checkpatch.pl happy
  * musicpal, tc6393xb, omap_lcdc, tcx: drop dead code for non-32-bit-RGB surfaces
  * Add new board: mps3-an524
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmBGEOgZHHBldGVyLm1h
 eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3jE7D/9WjvsQPfIPHTEmXGh9gdRp
 p+SDRpA+h+f1TH9a4Ohooi/4+KvXqnyrTa+/YBuUn2rphkpeOEK9N0j7BO8pKFzC
 pyDJ53oZiSygFwpju3j6sg/CWyWn1lzAHXDd2OzMR1KC+5qD62VnUdgmYU2AuJu+
 DyaN41ZfeaFOwQcbvzeDr73xqsAhHm7aQ8AY78Sx8be+W532fUjaceqsSafx0Ok7
 L8qZRo1Zz/h4A3A0YwMg5ry2T7kwviPYPzVrIOQu9n+jcRNC/4YRWfzvyLi/JqwS
 oPRFJ3iA3ulIxQxF7DH3xc84A8dDuaDfoTqsSTtt+5+TtdRJXkDyjeH9ICdhrHci
 DAy+1OlSbzaxEim3DBxTaZ721X/R3X3FW8DI9mt9KBPHmpzhWXHawLEtxQL8U7Yi
 qBz2HB5uONImuC9D1Ssx3f2/Ig1OrnSGtidotwXYffi0B6wQ+TUTHxVHQEznIi7T
 Muv35x9jHd179EmcTtyzPfJV5SeOcRiS91LHr2bO5c0tvHxTRgUqD1uzM4eVnjXj
 DyjgAKP3hujyKTjh+nkREcxkkhyWdsqAhoTdJlyhZJ/wMDc9oVoegikxBJ3XU02f
 vKQ2u5onZcE7tAVvHS93l+MVsDsB1tHmE3LEyu+D3GXZDiQFy8uFX3Thsu8CNUE0
 6CnFznXHnQFbqRNsF8O0NQ==
 =nphT
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210308' into staging

target-arm queue:
 * sbsa-ref: remove cortex-a53 from list of supported cpus
 * sbsa-ref: add 'max' to list of allowed cpus
 * target/arm: Add support for FEAT_SSBS, Speculative Store Bypass Safe
 * npcm7xx: add EMC model
 * xlnx-zynqmp: Remove obsolete 'has_rpu' property
 * target/arm: Speed up aarch64 TBL/TBX
 * virtio-mmio: improve virtio-mmio get_dev_path alog
 * target/arm: Use TCF0 and TFSRE0 for unprivileged tag checks
 * target/arm: Restrict v8M IDAU to TCG
 * target/arm/cpu: Update coding style to make checkpatch.pl happy
 * musicpal, tc6393xb, omap_lcdc, tcx: drop dead code for non-32-bit-RGB surfaces
 * Add new board: mps3-an524

# gpg: Signature made Mon 08 Mar 2021 11:56:24 GMT
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20210308: (49 commits)
  hw/arm/mps2: Update old infocenter.arm.com URLs
  docs/system/arm/mps2.rst: Document the new mps3-an524 board
  hw/arm/mps2-tz: Provide PL031 RTC on mps3-an524
  hw/arm/mps2-tz: Stub out USB controller for mps3-an524
  hw/arm/mps2-tz: Add new mps3-an524 board
  hw/arm/mps2-tz: Get armv7m_load_kernel() size argument from RAMInfo
  hw/arm/mps2-tz: Support ROMs as well as RAMs
  hw/arm/mps2-tz: Set MachineClass default_ram info from RAMInfo data
  hw/arm/mps2-tz: Make RAM arrangement board-specific
  hw/arm/mps2-tz: Allow boards to have different PPCInfo data
  hw/arm/mps2-tz: Size the uart-irq-orgate based on the number of UARTs
  hw/arm/mps2-tz: Move device IRQ info to data structures
  hw/arm/mps2-tz: Allow PPCPortInfo structures to specify device interrupts
  hw/arm/mps2-tz: Correct wrong interrupt numbers for DMA and SPI
  hw/misc/mps2-scc: Implement CFG_REG5 and CFG_REG6 for MPS3 AN524
  hw/arm/mps2-tz: Make number of IRQs board-specific
  hw/arm/mps2-tz: Condition IRQ splitting on number of CPUs, not board type
  hw/arm/mps2-tz: Make FPGAIO switch and LED config per-board
  hw/misc/mps2-fpgaio: Support SWITCH register
  hw/misc/mps2-fpgaio: Make number of LEDs configurable by board
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-08 11:57:36 +00:00
Peter Maydell
50b52b18cd hw/arm/mps2: Update old infocenter.arm.com URLs
Update old infocenter.arm.com URLs to the equivalent developer.arm.com
ones (the old URLs should redirect, but we might as well avoid the
redirection notice, and the new URLs are pleasantly shorter).

This commit covers the links to the MPS2 board TRM, the various
Application Notes, the IoTKit and SSE-200 documents.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210215115138.20465-25-peter.maydell@linaro.org
2021-03-08 11:54:16 +00:00
Peter Maydell
ced8bb04ae docs/system/arm/mps2.rst: Document the new mps3-an524 board
Add brief documentation of the new mps3-an524 board.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210215115138.20465-24-peter.maydell@linaro.org
2021-03-08 11:54:16 +00:00
Peter Maydell
41745d2053 hw/arm/mps2-tz: Provide PL031 RTC on mps3-an524
The AN524 has a PL031 RTC, which we have a model of; provide it
rather than an unimplemented-device stub.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210215115138.20465-23-peter.maydell@linaro.org
2021-03-08 11:54:16 +00:00
Peter Maydell
a9597753d1 hw/arm/mps2-tz: Stub out USB controller for mps3-an524
The AN524 has a USB controller (an ISP1763); we don't have a model of
it but we should provide a stub "unimplemented-device" for it.  This
is slightly complicated because the USB controller shares a PPC port
with the ethernet controller.

Implement a make_* function which provides creates a container
MemoryRegion with both the ethernet controller and an
unimplemented-device stub for the USB controller.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210215115138.20465-22-peter.maydell@linaro.org
2021-03-08 11:54:16 +00:00
Mark Cave-Ayland
7aa6baee7c esp: add support for unaligned accesses
When the MacOS toolbox ROM transfers data from a target device to an unaligned
memory address, the first/last byte of a 16-bit transfer needs to be handled
separately. This means that the first byte is preloaded into the FIFO before
the transfer, or the last byte remains in the FIFO after the transfer.

The result of this is that the PDMA routines must be updated so that the FIFO
is loaded/unloaded if the last 16-bit word is used (rather than the last byte)
and any remaining byte from a FIFO wraparound is handled correctly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-43-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
1b9e48a5bd esp: implement non-DMA transfers in PDMA mode
The MacOS toolbox ROM uses non-DMA TI commands to handle the first/last byte
of an unaligned 16-bit transfer to memory.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-42-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
238ec4d7d4 esp: add trivial implementation of the ESP_RFLAGS register
The bottom 5 bits contain the number of bytes remaining in the FIFO which is
trivial to implement with Fifo8 (the remaining bits are unimplemented and left
as 0 for now).

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-41-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
023666da79 esp: convert cmdbuf from array to Fifo8
Rename ESP_CMDBUF_SZ to ESP_CMDFIFO_SZ and cmdbuf_cdb_offset to cmdfifo_cdb_offset
to indicate that the command buffer type has changed from an array to a Fifo8.

This also enables us to remove the ESPState field cmdlen since the command length
is now simply the number of elements used in cmdfifo.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-40-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
042879fc3f esp: convert ti_buf from array to Fifo8
Rename TI_BUFSZ to ESP_FIFO_SZ since this constant is really describing the size
of the FIFO and is not directly related to the TI size.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-39-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
799d90d818 esp: transition to message out phase after SATN and stop command
The SCSI bus should remain in the message out phase after the SATN and stop
command rather than transitioning to the command phase. A new ESPState variable
cmdbuf_cdb_offset is added which stores the offset of the CDB from the start
of cmdbuf when accumulating extended message out phase data.

Currently any extended message out data is discarded in do_cmd() before the CDB
is processed in do_busid_cmd().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-38-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
20c8d2ed6a esp: add maxlen parameter to get_cmd()
Some guests use a mixture of DMA and non-DMA transfers in combination with the
SATN and stop command to transfer message out phase and command phase bytes to
the target. Prepare for the next commit by adding a maxlen parameter to
get_cmd() to allow partial transfers.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-37-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
4e0ed62937 esp: raise interrupt after every non-DMA byte transferred to the FIFO
This matches the description in the datasheet and is required as support for
non-DMA transfers is added.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-36-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
4aaa6ac383 esp: remove old deferred command completion mechanism
Commit ea84a44250 "scsi: esp: Defer command completion until previous interrupts
have been handled" provided a mechanism to delay the command completion interrupt
until ESP_RINTR is read after the command has completed.

With the previous fixes for latching the ESP_RINTR bits and deferring the setting
of the command completion interrupt for incoming data to the SCSI callback, this
workaround is no longer required and can be removed.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-35-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
4e78f3bf35 esp: defer command completion interrupt on incoming data transfers
The MacOS toolbox ROM issues a command to the ESP controller as part of its
"FAST" SCSI routines and then proceeds to read the incoming data soon after
receiving the command completion interrupt.

Unfortunately due to SCSI block transfers being asynchronous the incoming data
may not yet be present causing an underflow error. Resolve this by waiting for
the SCSI subsystem transfer_data callback before raising the command completion
interrupt.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-34-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
cf47a41e05 esp: latch individual bits in ESP_RINTR register
Currently the ESP_RINTR register is set to a specific value as required within
the ESP state machine. In order to implement the upcoming deferred interrupt
functionality it is necessary to set individual bits within ESP_RINTR so that
a deferred interrupt will not overwrite the value of any other interrupt bits.

This also requires fixing up a few locations where the ESP_RINTR and ESP_RSEQ
registers are set/reset unexpectedly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-33-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
bb27b13d18 esp: implement FIFO flush command
At this point it is now possible to properly implement the FIFO flush command
without causing guest errors.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-32-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
cf1b828600 esp: add 4 byte PDMA read and write transfers
The MacOS toolbox ROM performs 4 byte reads/writes when transferring data to
and from the target. Since the SCSI bus is 16-bits wide, use the memory API
to split a 4 byte access into 2 x 2 byte accesses.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-31-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
43d02df31b esp: remove pdma_origin from ESPState
Now that all data is transferred via the FIFO (ti_buf) there is no need to track
the source buffer being used for the data transfer. This also eliminates the
need for a separate subsection for PDMA state migration.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-30-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
82141c8b22 esp: use FIFO for PDMA transfers between initiator and device
PDMA as implemented on the Quadra 800 uses DREQ to load data into the FIFO
up to a maximum of 16 bytes at a time. The MacOS toolbox ROM requires this
because it mixes FIFO and PDMA transfers whilst checking the FIFO status
and counter registers to ensure success.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-29-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
496913153a esp: fix PDMA target selection
Currently the target selection for PDMA is done after the SCSI command has been
delivered which is not correct. Perform target selection as part of the initial
get_cmd() call when the command is submitted: if no target is present, don't
raise DRQ.

If the target is present then switch to the command phase since the MacOS toolbox
ROM checks for this before attempting to submit the SCSI command.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-28-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
c7bce09c05 esp: rename get_cmd_cb() to esp_select()
This better describes the purpose of the function.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-27-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
02abe24688 esp: remove CMD pdma_origin
The cmdbuf is really just a copy of FIFO data (including extra message phase
bytes) so its pdma_origin is effectively TI. Fortunately we already know when
we are receiving a SCSI command since do_cmd == 1 which enables us to
distinguish between the two cases in esp_pdma_read()/esp_pdma_write().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-26-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
3c421400ff esp: use in-built TC to determine PDMA transfer length
Real hardware simply counts down using the in-built TC to determine when the
the PDMA request is complete. Use the TC to determine the PDMA transfer length
which then enables us to remove the redundant pdma_len variable.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-25-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
ad7f468c42 esp: use ti_wptr/ti_rptr to manage the current FIFO position for PDMA
This eliminates the last user of the PDMA-specific pdma_cur variable which can
now be removed.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-24-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
93efe2e624 esp: move PDMA length adjustments into esp_pdma_read()/esp_pdma_write()
Here the updates to async_len and ti_size are moved into the corresponding
esp_pdma_read()/esp_pdma_write() function to eliminate the reference to
pdma_cur in do_dma_pdma_cb().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-23-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
2c573cfe19 esp: remove redundant pdma_start from ESPState
Now that PDMA SCSI commands are accumulated in cmdbuf in the same way as normal
commands, the existing logic for locating the start of the SCSI command in
cmdbuf via cmdlen can be used. This enables the PDMA-specific pdma_start and
also get_pdma_buf() to be removed.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-22-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
cfcea0f9d7 esp: remove the buf and buflen parameters from get_cmd()
Now that all SCSI commands are accumulated in cmdbuf, remove the buf and buflen
parameters from get_cmd() since these always reference cmdbuf and ESP_CMDBUF_SZ
respectively.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-21-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
c959f21843 esp: remove buf parameter from do_cmd()
Now that all SCSI commands are accumulated in cmdbuf, remove the buf parameter
from do_cmd() since this always points to cmdbuf.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-20-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
bb0bc7bbc9 esp: accumulate SCSI commands for PDMA transfers in cmdbuf instead of pdma_buf
ESP SCSI commands are already accumulated in cmdbuf and so there is no need to
keep a separate pdma_buf buffer. Accumulate SCSI commands for PDMA transfers in
cmdbuf instead of pdma_buf so update cmdlen accordingly and change pdma_origin
for PDMA transfers to CMD which allows the PDMA origin to be removed.

This commit also removes a stray memcpy() from get_cmd() which is a no-op because
cmdlen is always zero at the start of a command.

Notionally the removal of pdma_buf from vmstate_esp_pdma also breaks migration
compatibility for the PDMA subsection until its complete removal by the end of
the series.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-19-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
8da90e8194 esp: move pdma_len and TC logic into esp_pdma_read()/esp_pdma_write()
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-18-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
6e3fafa8bb esp: use pdma_origin directly in esp_pdma_read()/esp_pdma_write()
This is the first step in removing get_pdma_buf() from esp.c.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-17-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00
Mark Cave-Ayland
761bef75dd esp: introduce esp_pdma_read() and esp_pdma_write() functions
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210304221103.6369-16-mark.cave-ayland@ilande.co.uk>
2021-03-07 10:39:05 +00:00