1 /* 2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation 3 * 4 * Copyright (c) 2006 CodeSourcery. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the LGPL. 8 */ 9 10 /* Note: 11 * LSI53C810 emulation is incorrect, in the sense that it supports 12 * features added in later evolutions. This should not be a problem, 13 * as well-behaved operating systems will not try to use them. 14 */ 15 16 #include <assert.h> 17 18 #include "hw/hw.h" 19 #include "hw/pci/pci.h" 20 #include "hw/scsi/scsi.h" 21 #include "sysemu/dma.h" 22 23 //#define DEBUG_LSI 24 //#define DEBUG_LSI_REG 25 26 #ifdef DEBUG_LSI 27 #define DPRINTF(fmt, ...) \ 28 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0) 29 #define BADF(fmt, ...) \ 30 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0) 31 #else 32 #define DPRINTF(fmt, ...) do {} while(0) 33 #define BADF(fmt, ...) \ 34 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0) 35 #endif 36 37 #define LSI_MAX_DEVS 7 38 39 #define LSI_SCNTL0_TRG 0x01 40 #define LSI_SCNTL0_AAP 0x02 41 #define LSI_SCNTL0_EPC 0x08 42 #define LSI_SCNTL0_WATN 0x10 43 #define LSI_SCNTL0_START 0x20 44 45 #define LSI_SCNTL1_SST 0x01 46 #define LSI_SCNTL1_IARB 0x02 47 #define LSI_SCNTL1_AESP 0x04 48 #define LSI_SCNTL1_RST 0x08 49 #define LSI_SCNTL1_CON 0x10 50 #define LSI_SCNTL1_DHP 0x20 51 #define LSI_SCNTL1_ADB 0x40 52 #define LSI_SCNTL1_EXC 0x80 53 54 #define LSI_SCNTL2_WSR 0x01 55 #define LSI_SCNTL2_VUE0 0x02 56 #define LSI_SCNTL2_VUE1 0x04 57 #define LSI_SCNTL2_WSS 0x08 58 #define LSI_SCNTL2_SLPHBEN 0x10 59 #define LSI_SCNTL2_SLPMD 0x20 60 #define LSI_SCNTL2_CHM 0x40 61 #define LSI_SCNTL2_SDU 0x80 62 63 #define LSI_ISTAT0_DIP 0x01 64 #define LSI_ISTAT0_SIP 0x02 65 #define LSI_ISTAT0_INTF 0x04 66 #define LSI_ISTAT0_CON 0x08 67 #define LSI_ISTAT0_SEM 0x10 68 #define LSI_ISTAT0_SIGP 0x20 69 #define LSI_ISTAT0_SRST 0x40 70 #define LSI_ISTAT0_ABRT 0x80 71 72 #define LSI_ISTAT1_SI 0x01 73 #define LSI_ISTAT1_SRUN 0x02 74 #define LSI_ISTAT1_FLSH 0x04 75 76 #define LSI_SSTAT0_SDP0 0x01 77 #define LSI_SSTAT0_RST 0x02 78 #define LSI_SSTAT0_WOA 0x04 79 #define LSI_SSTAT0_LOA 0x08 80 #define LSI_SSTAT0_AIP 0x10 81 #define LSI_SSTAT0_OLF 0x20 82 #define LSI_SSTAT0_ORF 0x40 83 #define LSI_SSTAT0_ILF 0x80 84 85 #define LSI_SIST0_PAR 0x01 86 #define LSI_SIST0_RST 0x02 87 #define LSI_SIST0_UDC 0x04 88 #define LSI_SIST0_SGE 0x08 89 #define LSI_SIST0_RSL 0x10 90 #define LSI_SIST0_SEL 0x20 91 #define LSI_SIST0_CMP 0x40 92 #define LSI_SIST0_MA 0x80 93 94 #define LSI_SIST1_HTH 0x01 95 #define LSI_SIST1_GEN 0x02 96 #define LSI_SIST1_STO 0x04 97 #define LSI_SIST1_SBMC 0x10 98 99 #define LSI_SOCL_IO 0x01 100 #define LSI_SOCL_CD 0x02 101 #define LSI_SOCL_MSG 0x04 102 #define LSI_SOCL_ATN 0x08 103 #define LSI_SOCL_SEL 0x10 104 #define LSI_SOCL_BSY 0x20 105 #define LSI_SOCL_ACK 0x40 106 #define LSI_SOCL_REQ 0x80 107 108 #define LSI_DSTAT_IID 0x01 109 #define LSI_DSTAT_SIR 0x04 110 #define LSI_DSTAT_SSI 0x08 111 #define LSI_DSTAT_ABRT 0x10 112 #define LSI_DSTAT_BF 0x20 113 #define LSI_DSTAT_MDPE 0x40 114 #define LSI_DSTAT_DFE 0x80 115 116 #define LSI_DCNTL_COM 0x01 117 #define LSI_DCNTL_IRQD 0x02 118 #define LSI_DCNTL_STD 0x04 119 #define LSI_DCNTL_IRQM 0x08 120 #define LSI_DCNTL_SSM 0x10 121 #define LSI_DCNTL_PFEN 0x20 122 #define LSI_DCNTL_PFF 0x40 123 #define LSI_DCNTL_CLSE 0x80 124 125 #define LSI_DMODE_MAN 0x01 126 #define LSI_DMODE_BOF 0x02 127 #define LSI_DMODE_ERMP 0x04 128 #define LSI_DMODE_ERL 0x08 129 #define LSI_DMODE_DIOM 0x10 130 #define LSI_DMODE_SIOM 0x20 131 132 #define LSI_CTEST2_DACK 0x01 133 #define LSI_CTEST2_DREQ 0x02 134 #define LSI_CTEST2_TEOP 0x04 135 #define LSI_CTEST2_PCICIE 0x08 136 #define LSI_CTEST2_CM 0x10 137 #define LSI_CTEST2_CIO 0x20 138 #define LSI_CTEST2_SIGP 0x40 139 #define LSI_CTEST2_DDIR 0x80 140 141 #define LSI_CTEST5_BL2 0x04 142 #define LSI_CTEST5_DDIR 0x08 143 #define LSI_CTEST5_MASR 0x10 144 #define LSI_CTEST5_DFSN 0x20 145 #define LSI_CTEST5_BBCK 0x40 146 #define LSI_CTEST5_ADCK 0x80 147 148 #define LSI_CCNTL0_DILS 0x01 149 #define LSI_CCNTL0_DISFC 0x10 150 #define LSI_CCNTL0_ENNDJ 0x20 151 #define LSI_CCNTL0_PMJCTL 0x40 152 #define LSI_CCNTL0_ENPMJ 0x80 153 154 #define LSI_CCNTL1_EN64DBMV 0x01 155 #define LSI_CCNTL1_EN64TIBMV 0x02 156 #define LSI_CCNTL1_64TIMOD 0x04 157 #define LSI_CCNTL1_DDAC 0x08 158 #define LSI_CCNTL1_ZMOD 0x80 159 160 /* Enable Response to Reselection */ 161 #define LSI_SCID_RRE 0x60 162 163 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD) 164 165 #define PHASE_DO 0 166 #define PHASE_DI 1 167 #define PHASE_CMD 2 168 #define PHASE_ST 3 169 #define PHASE_MO 6 170 #define PHASE_MI 7 171 #define PHASE_MASK 7 172 173 /* Maximum length of MSG IN data. */ 174 #define LSI_MAX_MSGIN_LEN 8 175 176 /* Flag set if this is a tagged command. */ 177 #define LSI_TAG_VALID (1 << 16) 178 179 typedef struct lsi_request { 180 SCSIRequest *req; 181 uint32_t tag; 182 uint32_t dma_len; 183 uint8_t *dma_buf; 184 uint32_t pending; 185 int out; 186 QTAILQ_ENTRY(lsi_request) next; 187 } lsi_request; 188 189 typedef struct { 190 /*< private >*/ 191 PCIDevice parent_obj; 192 /*< public >*/ 193 194 MemoryRegion mmio_io; 195 MemoryRegion ram_io; 196 MemoryRegion io_io; 197 198 int carry; /* ??? Should this be an a visible register somewhere? */ 199 int status; 200 /* Action to take at the end of a MSG IN phase. 201 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */ 202 int msg_action; 203 int msg_len; 204 uint8_t msg[LSI_MAX_MSGIN_LEN]; 205 /* 0 if SCRIPTS are running or stopped. 206 * 1 if a Wait Reselect instruction has been issued. 207 * 2 if processing DMA from lsi_execute_script. 208 * 3 if a DMA operation is in progress. */ 209 int waiting; 210 SCSIBus bus; 211 int current_lun; 212 /* The tag is a combination of the device ID and the SCSI tag. */ 213 uint32_t select_tag; 214 int command_complete; 215 QTAILQ_HEAD(, lsi_request) queue; 216 lsi_request *current; 217 218 uint32_t dsa; 219 uint32_t temp; 220 uint32_t dnad; 221 uint32_t dbc; 222 uint8_t istat0; 223 uint8_t istat1; 224 uint8_t dcmd; 225 uint8_t dstat; 226 uint8_t dien; 227 uint8_t sist0; 228 uint8_t sist1; 229 uint8_t sien0; 230 uint8_t sien1; 231 uint8_t mbox0; 232 uint8_t mbox1; 233 uint8_t dfifo; 234 uint8_t ctest2; 235 uint8_t ctest3; 236 uint8_t ctest4; 237 uint8_t ctest5; 238 uint8_t ccntl0; 239 uint8_t ccntl1; 240 uint32_t dsp; 241 uint32_t dsps; 242 uint8_t dmode; 243 uint8_t dcntl; 244 uint8_t scntl0; 245 uint8_t scntl1; 246 uint8_t scntl2; 247 uint8_t scntl3; 248 uint8_t sstat0; 249 uint8_t sstat1; 250 uint8_t scid; 251 uint8_t sxfer; 252 uint8_t socl; 253 uint8_t sdid; 254 uint8_t ssid; 255 uint8_t sfbr; 256 uint8_t stest1; 257 uint8_t stest2; 258 uint8_t stest3; 259 uint8_t sidl; 260 uint8_t stime0; 261 uint8_t respid0; 262 uint8_t respid1; 263 uint32_t mmrs; 264 uint32_t mmws; 265 uint32_t sfs; 266 uint32_t drs; 267 uint32_t sbms; 268 uint32_t dbms; 269 uint32_t dnad64; 270 uint32_t pmjad1; 271 uint32_t pmjad2; 272 uint32_t rbc; 273 uint32_t ua; 274 uint32_t ia; 275 uint32_t sbc; 276 uint32_t csbc; 277 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */ 278 uint8_t sbr; 279 280 /* Script ram is stored as 32-bit words in host byteorder. */ 281 uint32_t script_ram[2048]; 282 } LSIState; 283 284 #define TYPE_LSI53C810 "lsi53c810" 285 #define TYPE_LSI53C895A "lsi53c895a" 286 287 #define LSI53C895A(obj) \ 288 OBJECT_CHECK(LSIState, (obj), TYPE_LSI53C895A) 289 290 static inline int lsi_irq_on_rsl(LSIState *s) 291 { 292 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE); 293 } 294 295 static void lsi_soft_reset(LSIState *s) 296 { 297 DPRINTF("Reset\n"); 298 s->carry = 0; 299 300 s->msg_action = 0; 301 s->msg_len = 0; 302 s->waiting = 0; 303 s->dsa = 0; 304 s->dnad = 0; 305 s->dbc = 0; 306 s->temp = 0; 307 memset(s->scratch, 0, sizeof(s->scratch)); 308 s->istat0 = 0; 309 s->istat1 = 0; 310 s->dcmd = 0x40; 311 s->dstat = LSI_DSTAT_DFE; 312 s->dien = 0; 313 s->sist0 = 0; 314 s->sist1 = 0; 315 s->sien0 = 0; 316 s->sien1 = 0; 317 s->mbox0 = 0; 318 s->mbox1 = 0; 319 s->dfifo = 0; 320 s->ctest2 = LSI_CTEST2_DACK; 321 s->ctest3 = 0; 322 s->ctest4 = 0; 323 s->ctest5 = 0; 324 s->ccntl0 = 0; 325 s->ccntl1 = 0; 326 s->dsp = 0; 327 s->dsps = 0; 328 s->dmode = 0; 329 s->dcntl = 0; 330 s->scntl0 = 0xc0; 331 s->scntl1 = 0; 332 s->scntl2 = 0; 333 s->scntl3 = 0; 334 s->sstat0 = 0; 335 s->sstat1 = 0; 336 s->scid = 7; 337 s->sxfer = 0; 338 s->socl = 0; 339 s->sdid = 0; 340 s->ssid = 0; 341 s->stest1 = 0; 342 s->stest2 = 0; 343 s->stest3 = 0; 344 s->sidl = 0; 345 s->stime0 = 0; 346 s->respid0 = 0x80; 347 s->respid1 = 0; 348 s->mmrs = 0; 349 s->mmws = 0; 350 s->sfs = 0; 351 s->drs = 0; 352 s->sbms = 0; 353 s->dbms = 0; 354 s->dnad64 = 0; 355 s->pmjad1 = 0; 356 s->pmjad2 = 0; 357 s->rbc = 0; 358 s->ua = 0; 359 s->ia = 0; 360 s->sbc = 0; 361 s->csbc = 0; 362 s->sbr = 0; 363 assert(QTAILQ_EMPTY(&s->queue)); 364 assert(!s->current); 365 } 366 367 static int lsi_dma_40bit(LSIState *s) 368 { 369 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT) 370 return 1; 371 return 0; 372 } 373 374 static int lsi_dma_ti64bit(LSIState *s) 375 { 376 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV) 377 return 1; 378 return 0; 379 } 380 381 static int lsi_dma_64bit(LSIState *s) 382 { 383 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV) 384 return 1; 385 return 0; 386 } 387 388 static uint8_t lsi_reg_readb(LSIState *s, int offset); 389 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val); 390 static void lsi_execute_script(LSIState *s); 391 static void lsi_reselect(LSIState *s, lsi_request *p); 392 393 static inline uint32_t read_dword(LSIState *s, uint32_t addr) 394 { 395 uint32_t buf; 396 397 pci_dma_read(PCI_DEVICE(s), addr, &buf, 4); 398 return cpu_to_le32(buf); 399 } 400 401 static void lsi_stop_script(LSIState *s) 402 { 403 s->istat1 &= ~LSI_ISTAT1_SRUN; 404 } 405 406 static void lsi_update_irq(LSIState *s) 407 { 408 PCIDevice *d = PCI_DEVICE(s); 409 int level; 410 static int last_level; 411 lsi_request *p; 412 413 /* It's unclear whether the DIP/SIP bits should be cleared when the 414 Interrupt Status Registers are cleared or when istat0 is read. 415 We currently do the formwer, which seems to work. */ 416 level = 0; 417 if (s->dstat) { 418 if (s->dstat & s->dien) 419 level = 1; 420 s->istat0 |= LSI_ISTAT0_DIP; 421 } else { 422 s->istat0 &= ~LSI_ISTAT0_DIP; 423 } 424 425 if (s->sist0 || s->sist1) { 426 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1)) 427 level = 1; 428 s->istat0 |= LSI_ISTAT0_SIP; 429 } else { 430 s->istat0 &= ~LSI_ISTAT0_SIP; 431 } 432 if (s->istat0 & LSI_ISTAT0_INTF) 433 level = 1; 434 435 if (level != last_level) { 436 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n", 437 level, s->dstat, s->sist1, s->sist0); 438 last_level = level; 439 } 440 pci_set_irq(d, level); 441 442 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) { 443 DPRINTF("Handled IRQs & disconnected, looking for pending " 444 "processes\n"); 445 QTAILQ_FOREACH(p, &s->queue, next) { 446 if (p->pending) { 447 lsi_reselect(s, p); 448 break; 449 } 450 } 451 } 452 } 453 454 /* Stop SCRIPTS execution and raise a SCSI interrupt. */ 455 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1) 456 { 457 uint32_t mask0; 458 uint32_t mask1; 459 460 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n", 461 stat1, stat0, s->sist1, s->sist0); 462 s->sist0 |= stat0; 463 s->sist1 |= stat1; 464 /* Stop processor on fatal or unmasked interrupt. As a special hack 465 we don't stop processing when raising STO. Instead continue 466 execution and stop at the next insn that accesses the SCSI bus. */ 467 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL); 468 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH); 469 mask1 &= ~LSI_SIST1_STO; 470 if (s->sist0 & mask0 || s->sist1 & mask1) { 471 lsi_stop_script(s); 472 } 473 lsi_update_irq(s); 474 } 475 476 /* Stop SCRIPTS execution and raise a DMA interrupt. */ 477 static void lsi_script_dma_interrupt(LSIState *s, int stat) 478 { 479 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat); 480 s->dstat |= stat; 481 lsi_update_irq(s); 482 lsi_stop_script(s); 483 } 484 485 static inline void lsi_set_phase(LSIState *s, int phase) 486 { 487 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase; 488 } 489 490 static void lsi_bad_phase(LSIState *s, int out, int new_phase) 491 { 492 /* Trigger a phase mismatch. */ 493 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) { 494 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) { 495 s->dsp = out ? s->pmjad1 : s->pmjad2; 496 } else { 497 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1); 498 } 499 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp); 500 } else { 501 DPRINTF("Phase mismatch interrupt\n"); 502 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0); 503 lsi_stop_script(s); 504 } 505 lsi_set_phase(s, new_phase); 506 } 507 508 509 /* Resume SCRIPTS execution after a DMA operation. */ 510 static void lsi_resume_script(LSIState *s) 511 { 512 if (s->waiting != 2) { 513 s->waiting = 0; 514 lsi_execute_script(s); 515 } else { 516 s->waiting = 0; 517 } 518 } 519 520 static void lsi_disconnect(LSIState *s) 521 { 522 s->scntl1 &= ~LSI_SCNTL1_CON; 523 s->sstat1 &= ~PHASE_MASK; 524 } 525 526 static void lsi_bad_selection(LSIState *s, uint32_t id) 527 { 528 DPRINTF("Selected absent target %d\n", id); 529 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO); 530 lsi_disconnect(s); 531 } 532 533 /* Initiate a SCSI layer data transfer. */ 534 static void lsi_do_dma(LSIState *s, int out) 535 { 536 PCIDevice *pci_dev; 537 uint32_t count; 538 dma_addr_t addr; 539 SCSIDevice *dev; 540 541 assert(s->current); 542 if (!s->current->dma_len) { 543 /* Wait until data is available. */ 544 DPRINTF("DMA no data available\n"); 545 return; 546 } 547 548 pci_dev = PCI_DEVICE(s); 549 dev = s->current->req->dev; 550 assert(dev); 551 552 count = s->dbc; 553 if (count > s->current->dma_len) 554 count = s->current->dma_len; 555 556 addr = s->dnad; 557 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */ 558 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s)) 559 addr |= ((uint64_t)s->dnad64 << 32); 560 else if (s->dbms) 561 addr |= ((uint64_t)s->dbms << 32); 562 else if (s->sbms) 563 addr |= ((uint64_t)s->sbms << 32); 564 565 DPRINTF("DMA addr=0x" DMA_ADDR_FMT " len=%d\n", addr, count); 566 s->csbc += count; 567 s->dnad += count; 568 s->dbc -= count; 569 if (s->current->dma_buf == NULL) { 570 s->current->dma_buf = scsi_req_get_buf(s->current->req); 571 } 572 /* ??? Set SFBR to first data byte. */ 573 if (out) { 574 pci_dma_read(pci_dev, addr, s->current->dma_buf, count); 575 } else { 576 pci_dma_write(pci_dev, addr, s->current->dma_buf, count); 577 } 578 s->current->dma_len -= count; 579 if (s->current->dma_len == 0) { 580 s->current->dma_buf = NULL; 581 scsi_req_continue(s->current->req); 582 } else { 583 s->current->dma_buf += count; 584 lsi_resume_script(s); 585 } 586 } 587 588 589 /* Add a command to the queue. */ 590 static void lsi_queue_command(LSIState *s) 591 { 592 lsi_request *p = s->current; 593 594 DPRINTF("Queueing tag=0x%x\n", p->tag); 595 assert(s->current != NULL); 596 assert(s->current->dma_len == 0); 597 QTAILQ_INSERT_TAIL(&s->queue, s->current, next); 598 s->current = NULL; 599 600 p->pending = 0; 601 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO; 602 } 603 604 /* Queue a byte for a MSG IN phase. */ 605 static void lsi_add_msg_byte(LSIState *s, uint8_t data) 606 { 607 if (s->msg_len >= LSI_MAX_MSGIN_LEN) { 608 BADF("MSG IN data too long\n"); 609 } else { 610 DPRINTF("MSG IN 0x%02x\n", data); 611 s->msg[s->msg_len++] = data; 612 } 613 } 614 615 /* Perform reselection to continue a command. */ 616 static void lsi_reselect(LSIState *s, lsi_request *p) 617 { 618 int id; 619 620 assert(s->current == NULL); 621 QTAILQ_REMOVE(&s->queue, p, next); 622 s->current = p; 623 624 id = (p->tag >> 8) & 0xf; 625 s->ssid = id | 0x80; 626 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */ 627 if (!(s->dcntl & LSI_DCNTL_COM)) { 628 s->sfbr = 1 << (id & 0x7); 629 } 630 DPRINTF("Reselected target %d\n", id); 631 s->scntl1 |= LSI_SCNTL1_CON; 632 lsi_set_phase(s, PHASE_MI); 633 s->msg_action = p->out ? 2 : 3; 634 s->current->dma_len = p->pending; 635 lsi_add_msg_byte(s, 0x80); 636 if (s->current->tag & LSI_TAG_VALID) { 637 lsi_add_msg_byte(s, 0x20); 638 lsi_add_msg_byte(s, p->tag & 0xff); 639 } 640 641 if (lsi_irq_on_rsl(s)) { 642 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0); 643 } 644 } 645 646 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag) 647 { 648 lsi_request *p; 649 650 QTAILQ_FOREACH(p, &s->queue, next) { 651 if (p->tag == tag) { 652 return p; 653 } 654 } 655 656 return NULL; 657 } 658 659 static void lsi_request_free(LSIState *s, lsi_request *p) 660 { 661 if (p == s->current) { 662 s->current = NULL; 663 } else { 664 QTAILQ_REMOVE(&s->queue, p, next); 665 } 666 g_free(p); 667 } 668 669 static void lsi_request_cancelled(SCSIRequest *req) 670 { 671 LSIState *s = LSI53C895A(req->bus->qbus.parent); 672 lsi_request *p = req->hba_private; 673 674 req->hba_private = NULL; 675 lsi_request_free(s, p); 676 scsi_req_unref(req); 677 } 678 679 /* Record that data is available for a queued command. Returns zero if 680 the device was reselected, nonzero if the IO is deferred. */ 681 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len) 682 { 683 lsi_request *p = req->hba_private; 684 685 if (p->pending) { 686 BADF("Multiple IO pending for request %p\n", p); 687 } 688 p->pending = len; 689 /* Reselect if waiting for it, or if reselection triggers an IRQ 690 and the bus is free. 691 Since no interrupt stacking is implemented in the emulation, it 692 is also required that there are no pending interrupts waiting 693 for service from the device driver. */ 694 if (s->waiting == 1 || 695 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) && 696 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) { 697 /* Reselect device. */ 698 lsi_reselect(s, p); 699 return 0; 700 } else { 701 DPRINTF("Queueing IO tag=0x%x\n", p->tag); 702 p->pending = len; 703 return 1; 704 } 705 } 706 707 /* Callback to indicate that the SCSI layer has completed a command. */ 708 static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid) 709 { 710 LSIState *s = LSI53C895A(req->bus->qbus.parent); 711 int out; 712 713 out = (s->sstat1 & PHASE_MASK) == PHASE_DO; 714 DPRINTF("Command complete status=%d\n", (int)status); 715 s->status = status; 716 s->command_complete = 2; 717 if (s->waiting && s->dbc != 0) { 718 /* Raise phase mismatch for short transfers. */ 719 lsi_bad_phase(s, out, PHASE_ST); 720 } else { 721 lsi_set_phase(s, PHASE_ST); 722 } 723 724 if (req->hba_private == s->current) { 725 req->hba_private = NULL; 726 lsi_request_free(s, s->current); 727 scsi_req_unref(req); 728 } 729 lsi_resume_script(s); 730 } 731 732 /* Callback to indicate that the SCSI layer has completed a transfer. */ 733 static void lsi_transfer_data(SCSIRequest *req, uint32_t len) 734 { 735 LSIState *s = LSI53C895A(req->bus->qbus.parent); 736 int out; 737 738 assert(req->hba_private); 739 if (s->waiting == 1 || req->hba_private != s->current || 740 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) { 741 if (lsi_queue_req(s, req, len)) { 742 return; 743 } 744 } 745 746 out = (s->sstat1 & PHASE_MASK) == PHASE_DO; 747 748 /* host adapter (re)connected */ 749 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len); 750 s->current->dma_len = len; 751 s->command_complete = 1; 752 if (s->waiting) { 753 if (s->waiting == 1 || s->dbc == 0) { 754 lsi_resume_script(s); 755 } else { 756 lsi_do_dma(s, out); 757 } 758 } 759 } 760 761 static void lsi_do_command(LSIState *s) 762 { 763 SCSIDevice *dev; 764 uint8_t buf[16]; 765 uint32_t id; 766 int n; 767 768 DPRINTF("Send command len=%d\n", s->dbc); 769 if (s->dbc > 16) 770 s->dbc = 16; 771 pci_dma_read(PCI_DEVICE(s), s->dnad, buf, s->dbc); 772 s->sfbr = buf[0]; 773 s->command_complete = 0; 774 775 id = (s->select_tag >> 8) & 0xf; 776 dev = scsi_device_find(&s->bus, 0, id, s->current_lun); 777 if (!dev) { 778 lsi_bad_selection(s, id); 779 return; 780 } 781 782 assert(s->current == NULL); 783 s->current = g_malloc0(sizeof(lsi_request)); 784 s->current->tag = s->select_tag; 785 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf, 786 s->current); 787 788 n = scsi_req_enqueue(s->current->req); 789 if (n) { 790 if (n > 0) { 791 lsi_set_phase(s, PHASE_DI); 792 } else if (n < 0) { 793 lsi_set_phase(s, PHASE_DO); 794 } 795 scsi_req_continue(s->current->req); 796 } 797 if (!s->command_complete) { 798 if (n) { 799 /* Command did not complete immediately so disconnect. */ 800 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */ 801 lsi_add_msg_byte(s, 4); /* DISCONNECT */ 802 /* wait data */ 803 lsi_set_phase(s, PHASE_MI); 804 s->msg_action = 1; 805 lsi_queue_command(s); 806 } else { 807 /* wait command complete */ 808 lsi_set_phase(s, PHASE_DI); 809 } 810 } 811 } 812 813 static void lsi_do_status(LSIState *s) 814 { 815 uint8_t status; 816 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status); 817 if (s->dbc != 1) 818 BADF("Bad Status move\n"); 819 s->dbc = 1; 820 status = s->status; 821 s->sfbr = status; 822 pci_dma_write(PCI_DEVICE(s), s->dnad, &status, 1); 823 lsi_set_phase(s, PHASE_MI); 824 s->msg_action = 1; 825 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */ 826 } 827 828 static void lsi_do_msgin(LSIState *s) 829 { 830 int len; 831 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len); 832 s->sfbr = s->msg[0]; 833 len = s->msg_len; 834 if (len > s->dbc) 835 len = s->dbc; 836 pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len); 837 /* Linux drivers rely on the last byte being in the SIDL. */ 838 s->sidl = s->msg[len - 1]; 839 s->msg_len -= len; 840 if (s->msg_len) { 841 memmove(s->msg, s->msg + len, s->msg_len); 842 } else { 843 /* ??? Check if ATN (not yet implemented) is asserted and maybe 844 switch to PHASE_MO. */ 845 switch (s->msg_action) { 846 case 0: 847 lsi_set_phase(s, PHASE_CMD); 848 break; 849 case 1: 850 lsi_disconnect(s); 851 break; 852 case 2: 853 lsi_set_phase(s, PHASE_DO); 854 break; 855 case 3: 856 lsi_set_phase(s, PHASE_DI); 857 break; 858 default: 859 abort(); 860 } 861 } 862 } 863 864 /* Read the next byte during a MSGOUT phase. */ 865 static uint8_t lsi_get_msgbyte(LSIState *s) 866 { 867 uint8_t data; 868 pci_dma_read(PCI_DEVICE(s), s->dnad, &data, 1); 869 s->dnad++; 870 s->dbc--; 871 return data; 872 } 873 874 /* Skip the next n bytes during a MSGOUT phase. */ 875 static void lsi_skip_msgbytes(LSIState *s, unsigned int n) 876 { 877 s->dnad += n; 878 s->dbc -= n; 879 } 880 881 static void lsi_do_msgout(LSIState *s) 882 { 883 uint8_t msg; 884 int len; 885 uint32_t current_tag; 886 lsi_request *current_req, *p, *p_next; 887 888 if (s->current) { 889 current_tag = s->current->tag; 890 current_req = s->current; 891 } else { 892 current_tag = s->select_tag; 893 current_req = lsi_find_by_tag(s, current_tag); 894 } 895 896 DPRINTF("MSG out len=%d\n", s->dbc); 897 while (s->dbc) { 898 msg = lsi_get_msgbyte(s); 899 s->sfbr = msg; 900 901 switch (msg) { 902 case 0x04: 903 DPRINTF("MSG: Disconnect\n"); 904 lsi_disconnect(s); 905 break; 906 case 0x08: 907 DPRINTF("MSG: No Operation\n"); 908 lsi_set_phase(s, PHASE_CMD); 909 break; 910 case 0x01: 911 len = lsi_get_msgbyte(s); 912 msg = lsi_get_msgbyte(s); 913 (void)len; /* avoid a warning about unused variable*/ 914 DPRINTF("Extended message 0x%x (len %d)\n", msg, len); 915 switch (msg) { 916 case 1: 917 DPRINTF("SDTR (ignored)\n"); 918 lsi_skip_msgbytes(s, 2); 919 break; 920 case 3: 921 DPRINTF("WDTR (ignored)\n"); 922 lsi_skip_msgbytes(s, 1); 923 break; 924 default: 925 goto bad; 926 } 927 break; 928 case 0x20: /* SIMPLE queue */ 929 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID; 930 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff); 931 break; 932 case 0x21: /* HEAD of queue */ 933 BADF("HEAD queue not implemented\n"); 934 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID; 935 break; 936 case 0x22: /* ORDERED queue */ 937 BADF("ORDERED queue not implemented\n"); 938 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID; 939 break; 940 case 0x0d: 941 /* The ABORT TAG message clears the current I/O process only. */ 942 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag); 943 if (current_req) { 944 scsi_req_cancel(current_req->req); 945 } 946 lsi_disconnect(s); 947 break; 948 case 0x06: 949 case 0x0e: 950 case 0x0c: 951 /* The ABORT message clears all I/O processes for the selecting 952 initiator on the specified logical unit of the target. */ 953 if (msg == 0x06) { 954 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag); 955 } 956 /* The CLEAR QUEUE message clears all I/O processes for all 957 initiators on the specified logical unit of the target. */ 958 if (msg == 0x0e) { 959 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag); 960 } 961 /* The BUS DEVICE RESET message clears all I/O processes for all 962 initiators on all logical units of the target. */ 963 if (msg == 0x0c) { 964 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag); 965 } 966 967 /* clear the current I/O process */ 968 if (s->current) { 969 scsi_req_cancel(s->current->req); 970 } 971 972 /* As the current implemented devices scsi_disk and scsi_generic 973 only support one LUN, we don't need to keep track of LUNs. 974 Clearing I/O processes for other initiators could be possible 975 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX 976 device, but this is currently not implemented (and seems not 977 to be really necessary). So let's simply clear all queued 978 commands for the current device: */ 979 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) { 980 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) { 981 scsi_req_cancel(p->req); 982 } 983 } 984 985 lsi_disconnect(s); 986 break; 987 default: 988 if ((msg & 0x80) == 0) { 989 goto bad; 990 } 991 s->current_lun = msg & 7; 992 DPRINTF("Select LUN %d\n", s->current_lun); 993 lsi_set_phase(s, PHASE_CMD); 994 break; 995 } 996 } 997 return; 998 bad: 999 BADF("Unimplemented message 0x%02x\n", msg); 1000 lsi_set_phase(s, PHASE_MI); 1001 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */ 1002 s->msg_action = 0; 1003 } 1004 1005 #define LSI_BUF_SIZE 4096 1006 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count) 1007 { 1008 PCIDevice *d = PCI_DEVICE(s); 1009 int n; 1010 uint8_t buf[LSI_BUF_SIZE]; 1011 1012 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count); 1013 while (count) { 1014 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count; 1015 pci_dma_read(d, src, buf, n); 1016 pci_dma_write(d, dest, buf, n); 1017 src += n; 1018 dest += n; 1019 count -= n; 1020 } 1021 } 1022 1023 static void lsi_wait_reselect(LSIState *s) 1024 { 1025 lsi_request *p; 1026 1027 DPRINTF("Wait Reselect\n"); 1028 1029 QTAILQ_FOREACH(p, &s->queue, next) { 1030 if (p->pending) { 1031 lsi_reselect(s, p); 1032 break; 1033 } 1034 } 1035 if (s->current == NULL) { 1036 s->waiting = 1; 1037 } 1038 } 1039 1040 static void lsi_execute_script(LSIState *s) 1041 { 1042 PCIDevice *pci_dev = PCI_DEVICE(s); 1043 uint32_t insn; 1044 uint32_t addr, addr_high; 1045 int opcode; 1046 int insn_processed = 0; 1047 1048 s->istat1 |= LSI_ISTAT1_SRUN; 1049 again: 1050 insn_processed++; 1051 insn = read_dword(s, s->dsp); 1052 if (!insn) { 1053 /* If we receive an empty opcode increment the DSP by 4 bytes 1054 instead of 8 and execute the next opcode at that location */ 1055 s->dsp += 4; 1056 goto again; 1057 } 1058 addr = read_dword(s, s->dsp + 4); 1059 addr_high = 0; 1060 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr); 1061 s->dsps = addr; 1062 s->dcmd = insn >> 24; 1063 s->dsp += 8; 1064 switch (insn >> 30) { 1065 case 0: /* Block move. */ 1066 if (s->sist1 & LSI_SIST1_STO) { 1067 DPRINTF("Delayed select timeout\n"); 1068 lsi_stop_script(s); 1069 break; 1070 } 1071 s->dbc = insn & 0xffffff; 1072 s->rbc = s->dbc; 1073 /* ??? Set ESA. */ 1074 s->ia = s->dsp - 8; 1075 if (insn & (1 << 29)) { 1076 /* Indirect addressing. */ 1077 addr = read_dword(s, addr); 1078 } else if (insn & (1 << 28)) { 1079 uint32_t buf[2]; 1080 int32_t offset; 1081 /* Table indirect addressing. */ 1082 1083 /* 32-bit Table indirect */ 1084 offset = sextract32(addr, 0, 24); 1085 pci_dma_read(pci_dev, s->dsa + offset, buf, 8); 1086 /* byte count is stored in bits 0:23 only */ 1087 s->dbc = cpu_to_le32(buf[0]) & 0xffffff; 1088 s->rbc = s->dbc; 1089 addr = cpu_to_le32(buf[1]); 1090 1091 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of 1092 * table, bits [31:24] */ 1093 if (lsi_dma_40bit(s)) 1094 addr_high = cpu_to_le32(buf[0]) >> 24; 1095 else if (lsi_dma_ti64bit(s)) { 1096 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f; 1097 switch (selector) { 1098 case 0 ... 0x0f: 1099 /* offset index into scratch registers since 1100 * TI64 mode can use registers C to R */ 1101 addr_high = s->scratch[2 + selector]; 1102 break; 1103 case 0x10: 1104 addr_high = s->mmrs; 1105 break; 1106 case 0x11: 1107 addr_high = s->mmws; 1108 break; 1109 case 0x12: 1110 addr_high = s->sfs; 1111 break; 1112 case 0x13: 1113 addr_high = s->drs; 1114 break; 1115 case 0x14: 1116 addr_high = s->sbms; 1117 break; 1118 case 0x15: 1119 addr_high = s->dbms; 1120 break; 1121 default: 1122 BADF("Illegal selector specified (0x%x > 0x15)" 1123 " for 64-bit DMA block move", selector); 1124 break; 1125 } 1126 } 1127 } else if (lsi_dma_64bit(s)) { 1128 /* fetch a 3rd dword if 64-bit direct move is enabled and 1129 only if we're not doing table indirect or indirect addressing */ 1130 s->dbms = read_dword(s, s->dsp); 1131 s->dsp += 4; 1132 s->ia = s->dsp - 12; 1133 } 1134 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) { 1135 DPRINTF("Wrong phase got %d expected %d\n", 1136 s->sstat1 & PHASE_MASK, (insn >> 24) & 7); 1137 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0); 1138 break; 1139 } 1140 s->dnad = addr; 1141 s->dnad64 = addr_high; 1142 switch (s->sstat1 & 0x7) { 1143 case PHASE_DO: 1144 s->waiting = 2; 1145 lsi_do_dma(s, 1); 1146 if (s->waiting) 1147 s->waiting = 3; 1148 break; 1149 case PHASE_DI: 1150 s->waiting = 2; 1151 lsi_do_dma(s, 0); 1152 if (s->waiting) 1153 s->waiting = 3; 1154 break; 1155 case PHASE_CMD: 1156 lsi_do_command(s); 1157 break; 1158 case PHASE_ST: 1159 lsi_do_status(s); 1160 break; 1161 case PHASE_MO: 1162 lsi_do_msgout(s); 1163 break; 1164 case PHASE_MI: 1165 lsi_do_msgin(s); 1166 break; 1167 default: 1168 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK); 1169 exit(1); 1170 } 1171 s->dfifo = s->dbc & 0xff; 1172 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3); 1173 s->sbc = s->dbc; 1174 s->rbc -= s->dbc; 1175 s->ua = addr + s->dbc; 1176 break; 1177 1178 case 1: /* IO or Read/Write instruction. */ 1179 opcode = (insn >> 27) & 7; 1180 if (opcode < 5) { 1181 uint32_t id; 1182 1183 if (insn & (1 << 25)) { 1184 id = read_dword(s, s->dsa + sextract32(insn, 0, 24)); 1185 } else { 1186 id = insn; 1187 } 1188 id = (id >> 16) & 0xf; 1189 if (insn & (1 << 26)) { 1190 addr = s->dsp + sextract32(addr, 0, 24); 1191 } 1192 s->dnad = addr; 1193 switch (opcode) { 1194 case 0: /* Select */ 1195 s->sdid = id; 1196 if (s->scntl1 & LSI_SCNTL1_CON) { 1197 DPRINTF("Already reselected, jumping to alternative address\n"); 1198 s->dsp = s->dnad; 1199 break; 1200 } 1201 s->sstat0 |= LSI_SSTAT0_WOA; 1202 s->scntl1 &= ~LSI_SCNTL1_IARB; 1203 if (!scsi_device_find(&s->bus, 0, id, 0)) { 1204 lsi_bad_selection(s, id); 1205 break; 1206 } 1207 DPRINTF("Selected target %d%s\n", 1208 id, insn & (1 << 3) ? " ATN" : ""); 1209 /* ??? Linux drivers compain when this is set. Maybe 1210 it only applies in low-level mode (unimplemented). 1211 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */ 1212 s->select_tag = id << 8; 1213 s->scntl1 |= LSI_SCNTL1_CON; 1214 if (insn & (1 << 3)) { 1215 s->socl |= LSI_SOCL_ATN; 1216 } 1217 lsi_set_phase(s, PHASE_MO); 1218 break; 1219 case 1: /* Disconnect */ 1220 DPRINTF("Wait Disconnect\n"); 1221 s->scntl1 &= ~LSI_SCNTL1_CON; 1222 break; 1223 case 2: /* Wait Reselect */ 1224 if (!lsi_irq_on_rsl(s)) { 1225 lsi_wait_reselect(s); 1226 } 1227 break; 1228 case 3: /* Set */ 1229 DPRINTF("Set%s%s%s%s\n", 1230 insn & (1 << 3) ? " ATN" : "", 1231 insn & (1 << 6) ? " ACK" : "", 1232 insn & (1 << 9) ? " TM" : "", 1233 insn & (1 << 10) ? " CC" : ""); 1234 if (insn & (1 << 3)) { 1235 s->socl |= LSI_SOCL_ATN; 1236 lsi_set_phase(s, PHASE_MO); 1237 } 1238 if (insn & (1 << 9)) { 1239 BADF("Target mode not implemented\n"); 1240 exit(1); 1241 } 1242 if (insn & (1 << 10)) 1243 s->carry = 1; 1244 break; 1245 case 4: /* Clear */ 1246 DPRINTF("Clear%s%s%s%s\n", 1247 insn & (1 << 3) ? " ATN" : "", 1248 insn & (1 << 6) ? " ACK" : "", 1249 insn & (1 << 9) ? " TM" : "", 1250 insn & (1 << 10) ? " CC" : ""); 1251 if (insn & (1 << 3)) { 1252 s->socl &= ~LSI_SOCL_ATN; 1253 } 1254 if (insn & (1 << 10)) 1255 s->carry = 0; 1256 break; 1257 } 1258 } else { 1259 uint8_t op0; 1260 uint8_t op1; 1261 uint8_t data8; 1262 int reg; 1263 int operator; 1264 #ifdef DEBUG_LSI 1265 static const char *opcode_names[3] = 1266 {"Write", "Read", "Read-Modify-Write"}; 1267 static const char *operator_names[8] = 1268 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"}; 1269 #endif 1270 1271 reg = ((insn >> 16) & 0x7f) | (insn & 0x80); 1272 data8 = (insn >> 8) & 0xff; 1273 opcode = (insn >> 27) & 7; 1274 operator = (insn >> 24) & 7; 1275 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n", 1276 opcode_names[opcode - 5], reg, 1277 operator_names[operator], data8, s->sfbr, 1278 (insn & (1 << 23)) ? " SFBR" : ""); 1279 op0 = op1 = 0; 1280 switch (opcode) { 1281 case 5: /* From SFBR */ 1282 op0 = s->sfbr; 1283 op1 = data8; 1284 break; 1285 case 6: /* To SFBR */ 1286 if (operator) 1287 op0 = lsi_reg_readb(s, reg); 1288 op1 = data8; 1289 break; 1290 case 7: /* Read-modify-write */ 1291 if (operator) 1292 op0 = lsi_reg_readb(s, reg); 1293 if (insn & (1 << 23)) { 1294 op1 = s->sfbr; 1295 } else { 1296 op1 = data8; 1297 } 1298 break; 1299 } 1300 1301 switch (operator) { 1302 case 0: /* move */ 1303 op0 = op1; 1304 break; 1305 case 1: /* Shift left */ 1306 op1 = op0 >> 7; 1307 op0 = (op0 << 1) | s->carry; 1308 s->carry = op1; 1309 break; 1310 case 2: /* OR */ 1311 op0 |= op1; 1312 break; 1313 case 3: /* XOR */ 1314 op0 ^= op1; 1315 break; 1316 case 4: /* AND */ 1317 op0 &= op1; 1318 break; 1319 case 5: /* SHR */ 1320 op1 = op0 & 1; 1321 op0 = (op0 >> 1) | (s->carry << 7); 1322 s->carry = op1; 1323 break; 1324 case 6: /* ADD */ 1325 op0 += op1; 1326 s->carry = op0 < op1; 1327 break; 1328 case 7: /* ADC */ 1329 op0 += op1 + s->carry; 1330 if (s->carry) 1331 s->carry = op0 <= op1; 1332 else 1333 s->carry = op0 < op1; 1334 break; 1335 } 1336 1337 switch (opcode) { 1338 case 5: /* From SFBR */ 1339 case 7: /* Read-modify-write */ 1340 lsi_reg_writeb(s, reg, op0); 1341 break; 1342 case 6: /* To SFBR */ 1343 s->sfbr = op0; 1344 break; 1345 } 1346 } 1347 break; 1348 1349 case 2: /* Transfer Control. */ 1350 { 1351 int cond; 1352 int jmp; 1353 1354 if ((insn & 0x002e0000) == 0) { 1355 DPRINTF("NOP\n"); 1356 break; 1357 } 1358 if (s->sist1 & LSI_SIST1_STO) { 1359 DPRINTF("Delayed select timeout\n"); 1360 lsi_stop_script(s); 1361 break; 1362 } 1363 cond = jmp = (insn & (1 << 19)) != 0; 1364 if (cond == jmp && (insn & (1 << 21))) { 1365 DPRINTF("Compare carry %d\n", s->carry == jmp); 1366 cond = s->carry != 0; 1367 } 1368 if (cond == jmp && (insn & (1 << 17))) { 1369 DPRINTF("Compare phase %d %c= %d\n", 1370 (s->sstat1 & PHASE_MASK), 1371 jmp ? '=' : '!', 1372 ((insn >> 24) & 7)); 1373 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7); 1374 } 1375 if (cond == jmp && (insn & (1 << 18))) { 1376 uint8_t mask; 1377 1378 mask = (~insn >> 8) & 0xff; 1379 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n", 1380 s->sfbr, mask, jmp ? '=' : '!', insn & mask); 1381 cond = (s->sfbr & mask) == (insn & mask); 1382 } 1383 if (cond == jmp) { 1384 if (insn & (1 << 23)) { 1385 /* Relative address. */ 1386 addr = s->dsp + sextract32(addr, 0, 24); 1387 } 1388 switch ((insn >> 27) & 7) { 1389 case 0: /* Jump */ 1390 DPRINTF("Jump to 0x%08x\n", addr); 1391 s->dsp = addr; 1392 break; 1393 case 1: /* Call */ 1394 DPRINTF("Call 0x%08x\n", addr); 1395 s->temp = s->dsp; 1396 s->dsp = addr; 1397 break; 1398 case 2: /* Return */ 1399 DPRINTF("Return to 0x%08x\n", s->temp); 1400 s->dsp = s->temp; 1401 break; 1402 case 3: /* Interrupt */ 1403 DPRINTF("Interrupt 0x%08x\n", s->dsps); 1404 if ((insn & (1 << 20)) != 0) { 1405 s->istat0 |= LSI_ISTAT0_INTF; 1406 lsi_update_irq(s); 1407 } else { 1408 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR); 1409 } 1410 break; 1411 default: 1412 DPRINTF("Illegal transfer control\n"); 1413 lsi_script_dma_interrupt(s, LSI_DSTAT_IID); 1414 break; 1415 } 1416 } else { 1417 DPRINTF("Control condition failed\n"); 1418 } 1419 } 1420 break; 1421 1422 case 3: 1423 if ((insn & (1 << 29)) == 0) { 1424 /* Memory move. */ 1425 uint32_t dest; 1426 /* ??? The docs imply the destination address is loaded into 1427 the TEMP register. However the Linux drivers rely on 1428 the value being presrved. */ 1429 dest = read_dword(s, s->dsp); 1430 s->dsp += 4; 1431 lsi_memcpy(s, dest, addr, insn & 0xffffff); 1432 } else { 1433 uint8_t data[7]; 1434 int reg; 1435 int n; 1436 int i; 1437 1438 if (insn & (1 << 28)) { 1439 addr = s->dsa + sextract32(addr, 0, 24); 1440 } 1441 n = (insn & 7); 1442 reg = (insn >> 16) & 0xff; 1443 if (insn & (1 << 24)) { 1444 pci_dma_read(pci_dev, addr, data, n); 1445 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n, 1446 addr, *(int *)data); 1447 for (i = 0; i < n; i++) { 1448 lsi_reg_writeb(s, reg + i, data[i]); 1449 } 1450 } else { 1451 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr); 1452 for (i = 0; i < n; i++) { 1453 data[i] = lsi_reg_readb(s, reg + i); 1454 } 1455 pci_dma_write(pci_dev, addr, data, n); 1456 } 1457 } 1458 } 1459 if (insn_processed > 10000 && !s->waiting) { 1460 /* Some windows drivers make the device spin waiting for a memory 1461 location to change. If we have been executed a lot of code then 1462 assume this is the case and force an unexpected device disconnect. 1463 This is apparently sufficient to beat the drivers into submission. 1464 */ 1465 if (!(s->sien0 & LSI_SIST0_UDC)) 1466 fprintf(stderr, "inf. loop with UDC masked\n"); 1467 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0); 1468 lsi_disconnect(s); 1469 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) { 1470 if (s->dcntl & LSI_DCNTL_SSM) { 1471 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI); 1472 } else { 1473 goto again; 1474 } 1475 } 1476 DPRINTF("SCRIPTS execution stopped\n"); 1477 } 1478 1479 static uint8_t lsi_reg_readb(LSIState *s, int offset) 1480 { 1481 uint8_t tmp; 1482 #define CASE_GET_REG24(name, addr) \ 1483 case addr: return s->name & 0xff; \ 1484 case addr + 1: return (s->name >> 8) & 0xff; \ 1485 case addr + 2: return (s->name >> 16) & 0xff; 1486 1487 #define CASE_GET_REG32(name, addr) \ 1488 case addr: return s->name & 0xff; \ 1489 case addr + 1: return (s->name >> 8) & 0xff; \ 1490 case addr + 2: return (s->name >> 16) & 0xff; \ 1491 case addr + 3: return (s->name >> 24) & 0xff; 1492 1493 #ifdef DEBUG_LSI_REG 1494 DPRINTF("Read reg %x\n", offset); 1495 #endif 1496 switch (offset) { 1497 case 0x00: /* SCNTL0 */ 1498 return s->scntl0; 1499 case 0x01: /* SCNTL1 */ 1500 return s->scntl1; 1501 case 0x02: /* SCNTL2 */ 1502 return s->scntl2; 1503 case 0x03: /* SCNTL3 */ 1504 return s->scntl3; 1505 case 0x04: /* SCID */ 1506 return s->scid; 1507 case 0x05: /* SXFER */ 1508 return s->sxfer; 1509 case 0x06: /* SDID */ 1510 return s->sdid; 1511 case 0x07: /* GPREG0 */ 1512 return 0x7f; 1513 case 0x08: /* Revision ID */ 1514 return 0x00; 1515 case 0xa: /* SSID */ 1516 return s->ssid; 1517 case 0xb: /* SBCL */ 1518 /* ??? This is not correct. However it's (hopefully) only 1519 used for diagnostics, so should be ok. */ 1520 return 0; 1521 case 0xc: /* DSTAT */ 1522 tmp = s->dstat | LSI_DSTAT_DFE; 1523 if ((s->istat0 & LSI_ISTAT0_INTF) == 0) 1524 s->dstat = 0; 1525 lsi_update_irq(s); 1526 return tmp; 1527 case 0x0d: /* SSTAT0 */ 1528 return s->sstat0; 1529 case 0x0e: /* SSTAT1 */ 1530 return s->sstat1; 1531 case 0x0f: /* SSTAT2 */ 1532 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2; 1533 CASE_GET_REG32(dsa, 0x10) 1534 case 0x14: /* ISTAT0 */ 1535 return s->istat0; 1536 case 0x15: /* ISTAT1 */ 1537 return s->istat1; 1538 case 0x16: /* MBOX0 */ 1539 return s->mbox0; 1540 case 0x17: /* MBOX1 */ 1541 return s->mbox1; 1542 case 0x18: /* CTEST0 */ 1543 return 0xff; 1544 case 0x19: /* CTEST1 */ 1545 return 0; 1546 case 0x1a: /* CTEST2 */ 1547 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM; 1548 if (s->istat0 & LSI_ISTAT0_SIGP) { 1549 s->istat0 &= ~LSI_ISTAT0_SIGP; 1550 tmp |= LSI_CTEST2_SIGP; 1551 } 1552 return tmp; 1553 case 0x1b: /* CTEST3 */ 1554 return s->ctest3; 1555 CASE_GET_REG32(temp, 0x1c) 1556 case 0x20: /* DFIFO */ 1557 return 0; 1558 case 0x21: /* CTEST4 */ 1559 return s->ctest4; 1560 case 0x22: /* CTEST5 */ 1561 return s->ctest5; 1562 case 0x23: /* CTEST6 */ 1563 return 0; 1564 CASE_GET_REG24(dbc, 0x24) 1565 case 0x27: /* DCMD */ 1566 return s->dcmd; 1567 CASE_GET_REG32(dnad, 0x28) 1568 CASE_GET_REG32(dsp, 0x2c) 1569 CASE_GET_REG32(dsps, 0x30) 1570 CASE_GET_REG32(scratch[0], 0x34) 1571 case 0x38: /* DMODE */ 1572 return s->dmode; 1573 case 0x39: /* DIEN */ 1574 return s->dien; 1575 case 0x3a: /* SBR */ 1576 return s->sbr; 1577 case 0x3b: /* DCNTL */ 1578 return s->dcntl; 1579 case 0x40: /* SIEN0 */ 1580 return s->sien0; 1581 case 0x41: /* SIEN1 */ 1582 return s->sien1; 1583 case 0x42: /* SIST0 */ 1584 tmp = s->sist0; 1585 s->sist0 = 0; 1586 lsi_update_irq(s); 1587 return tmp; 1588 case 0x43: /* SIST1 */ 1589 tmp = s->sist1; 1590 s->sist1 = 0; 1591 lsi_update_irq(s); 1592 return tmp; 1593 case 0x46: /* MACNTL */ 1594 return 0x0f; 1595 case 0x47: /* GPCNTL0 */ 1596 return 0x0f; 1597 case 0x48: /* STIME0 */ 1598 return s->stime0; 1599 case 0x4a: /* RESPID0 */ 1600 return s->respid0; 1601 case 0x4b: /* RESPID1 */ 1602 return s->respid1; 1603 case 0x4d: /* STEST1 */ 1604 return s->stest1; 1605 case 0x4e: /* STEST2 */ 1606 return s->stest2; 1607 case 0x4f: /* STEST3 */ 1608 return s->stest3; 1609 case 0x50: /* SIDL */ 1610 /* This is needed by the linux drivers. We currently only update it 1611 during the MSG IN phase. */ 1612 return s->sidl; 1613 case 0x52: /* STEST4 */ 1614 return 0xe0; 1615 case 0x56: /* CCNTL0 */ 1616 return s->ccntl0; 1617 case 0x57: /* CCNTL1 */ 1618 return s->ccntl1; 1619 case 0x58: /* SBDL */ 1620 /* Some drivers peek at the data bus during the MSG IN phase. */ 1621 if ((s->sstat1 & PHASE_MASK) == PHASE_MI) 1622 return s->msg[0]; 1623 return 0; 1624 case 0x59: /* SBDL high */ 1625 return 0; 1626 CASE_GET_REG32(mmrs, 0xa0) 1627 CASE_GET_REG32(mmws, 0xa4) 1628 CASE_GET_REG32(sfs, 0xa8) 1629 CASE_GET_REG32(drs, 0xac) 1630 CASE_GET_REG32(sbms, 0xb0) 1631 CASE_GET_REG32(dbms, 0xb4) 1632 CASE_GET_REG32(dnad64, 0xb8) 1633 CASE_GET_REG32(pmjad1, 0xc0) 1634 CASE_GET_REG32(pmjad2, 0xc4) 1635 CASE_GET_REG32(rbc, 0xc8) 1636 CASE_GET_REG32(ua, 0xcc) 1637 CASE_GET_REG32(ia, 0xd4) 1638 CASE_GET_REG32(sbc, 0xd8) 1639 CASE_GET_REG32(csbc, 0xdc) 1640 } 1641 if (offset >= 0x5c && offset < 0xa0) { 1642 int n; 1643 int shift; 1644 n = (offset - 0x58) >> 2; 1645 shift = (offset & 3) * 8; 1646 return (s->scratch[n] >> shift) & 0xff; 1647 } 1648 BADF("readb 0x%x\n", offset); 1649 exit(1); 1650 #undef CASE_GET_REG24 1651 #undef CASE_GET_REG32 1652 } 1653 1654 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val) 1655 { 1656 #define CASE_SET_REG24(name, addr) \ 1657 case addr : s->name &= 0xffffff00; s->name |= val; break; \ 1658 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \ 1659 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; 1660 1661 #define CASE_SET_REG32(name, addr) \ 1662 case addr : s->name &= 0xffffff00; s->name |= val; break; \ 1663 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \ 1664 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \ 1665 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break; 1666 1667 #ifdef DEBUG_LSI_REG 1668 DPRINTF("Write reg %x = %02x\n", offset, val); 1669 #endif 1670 switch (offset) { 1671 case 0x00: /* SCNTL0 */ 1672 s->scntl0 = val; 1673 if (val & LSI_SCNTL0_START) { 1674 BADF("Start sequence not implemented\n"); 1675 } 1676 break; 1677 case 0x01: /* SCNTL1 */ 1678 s->scntl1 = val & ~LSI_SCNTL1_SST; 1679 if (val & LSI_SCNTL1_IARB) { 1680 BADF("Immediate Arbritration not implemented\n"); 1681 } 1682 if (val & LSI_SCNTL1_RST) { 1683 if (!(s->sstat0 & LSI_SSTAT0_RST)) { 1684 qbus_reset_all(&s->bus.qbus); 1685 s->sstat0 |= LSI_SSTAT0_RST; 1686 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0); 1687 } 1688 } else { 1689 s->sstat0 &= ~LSI_SSTAT0_RST; 1690 } 1691 break; 1692 case 0x02: /* SCNTL2 */ 1693 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS); 1694 s->scntl2 = val; 1695 break; 1696 case 0x03: /* SCNTL3 */ 1697 s->scntl3 = val; 1698 break; 1699 case 0x04: /* SCID */ 1700 s->scid = val; 1701 break; 1702 case 0x05: /* SXFER */ 1703 s->sxfer = val; 1704 break; 1705 case 0x06: /* SDID */ 1706 if ((s->ssid & 0x80) && (val & 0xf) != (s->ssid & 0xf)) { 1707 BADF("Destination ID does not match SSID\n"); 1708 } 1709 s->sdid = val & 0xf; 1710 break; 1711 case 0x07: /* GPREG0 */ 1712 break; 1713 case 0x08: /* SFBR */ 1714 /* The CPU is not allowed to write to this register. However the 1715 SCRIPTS register move instructions are. */ 1716 s->sfbr = val; 1717 break; 1718 case 0x0a: case 0x0b: 1719 /* Openserver writes to these readonly registers on startup */ 1720 return; 1721 case 0x0c: case 0x0d: case 0x0e: case 0x0f: 1722 /* Linux writes to these readonly registers on startup. */ 1723 return; 1724 CASE_SET_REG32(dsa, 0x10) 1725 case 0x14: /* ISTAT0 */ 1726 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0); 1727 if (val & LSI_ISTAT0_ABRT) { 1728 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT); 1729 } 1730 if (val & LSI_ISTAT0_INTF) { 1731 s->istat0 &= ~LSI_ISTAT0_INTF; 1732 lsi_update_irq(s); 1733 } 1734 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) { 1735 DPRINTF("Woken by SIGP\n"); 1736 s->waiting = 0; 1737 s->dsp = s->dnad; 1738 lsi_execute_script(s); 1739 } 1740 if (val & LSI_ISTAT0_SRST) { 1741 qdev_reset_all(DEVICE(s)); 1742 } 1743 break; 1744 case 0x16: /* MBOX0 */ 1745 s->mbox0 = val; 1746 break; 1747 case 0x17: /* MBOX1 */ 1748 s->mbox1 = val; 1749 break; 1750 case 0x18: /* CTEST0 */ 1751 /* nothing to do */ 1752 break; 1753 case 0x1a: /* CTEST2 */ 1754 s->ctest2 = val & LSI_CTEST2_PCICIE; 1755 break; 1756 case 0x1b: /* CTEST3 */ 1757 s->ctest3 = val & 0x0f; 1758 break; 1759 CASE_SET_REG32(temp, 0x1c) 1760 case 0x21: /* CTEST4 */ 1761 if (val & 7) { 1762 BADF("Unimplemented CTEST4-FBL 0x%x\n", val); 1763 } 1764 s->ctest4 = val; 1765 break; 1766 case 0x22: /* CTEST5 */ 1767 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) { 1768 BADF("CTEST5 DMA increment not implemented\n"); 1769 } 1770 s->ctest5 = val; 1771 break; 1772 CASE_SET_REG24(dbc, 0x24) 1773 CASE_SET_REG32(dnad, 0x28) 1774 case 0x2c: /* DSP[0:7] */ 1775 s->dsp &= 0xffffff00; 1776 s->dsp |= val; 1777 break; 1778 case 0x2d: /* DSP[8:15] */ 1779 s->dsp &= 0xffff00ff; 1780 s->dsp |= val << 8; 1781 break; 1782 case 0x2e: /* DSP[16:23] */ 1783 s->dsp &= 0xff00ffff; 1784 s->dsp |= val << 16; 1785 break; 1786 case 0x2f: /* DSP[24:31] */ 1787 s->dsp &= 0x00ffffff; 1788 s->dsp |= val << 24; 1789 if ((s->dmode & LSI_DMODE_MAN) == 0 1790 && (s->istat1 & LSI_ISTAT1_SRUN) == 0) 1791 lsi_execute_script(s); 1792 break; 1793 CASE_SET_REG32(dsps, 0x30) 1794 CASE_SET_REG32(scratch[0], 0x34) 1795 case 0x38: /* DMODE */ 1796 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) { 1797 BADF("IO mappings not implemented\n"); 1798 } 1799 s->dmode = val; 1800 break; 1801 case 0x39: /* DIEN */ 1802 s->dien = val; 1803 lsi_update_irq(s); 1804 break; 1805 case 0x3a: /* SBR */ 1806 s->sbr = val; 1807 break; 1808 case 0x3b: /* DCNTL */ 1809 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD); 1810 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0) 1811 lsi_execute_script(s); 1812 break; 1813 case 0x40: /* SIEN0 */ 1814 s->sien0 = val; 1815 lsi_update_irq(s); 1816 break; 1817 case 0x41: /* SIEN1 */ 1818 s->sien1 = val; 1819 lsi_update_irq(s); 1820 break; 1821 case 0x47: /* GPCNTL0 */ 1822 break; 1823 case 0x48: /* STIME0 */ 1824 s->stime0 = val; 1825 break; 1826 case 0x49: /* STIME1 */ 1827 if (val & 0xf) { 1828 DPRINTF("General purpose timer not implemented\n"); 1829 /* ??? Raising the interrupt immediately seems to be sufficient 1830 to keep the FreeBSD driver happy. */ 1831 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN); 1832 } 1833 break; 1834 case 0x4a: /* RESPID0 */ 1835 s->respid0 = val; 1836 break; 1837 case 0x4b: /* RESPID1 */ 1838 s->respid1 = val; 1839 break; 1840 case 0x4d: /* STEST1 */ 1841 s->stest1 = val; 1842 break; 1843 case 0x4e: /* STEST2 */ 1844 if (val & 1) { 1845 BADF("Low level mode not implemented\n"); 1846 } 1847 s->stest2 = val; 1848 break; 1849 case 0x4f: /* STEST3 */ 1850 if (val & 0x41) { 1851 BADF("SCSI FIFO test mode not implemented\n"); 1852 } 1853 s->stest3 = val; 1854 break; 1855 case 0x56: /* CCNTL0 */ 1856 s->ccntl0 = val; 1857 break; 1858 case 0x57: /* CCNTL1 */ 1859 s->ccntl1 = val; 1860 break; 1861 CASE_SET_REG32(mmrs, 0xa0) 1862 CASE_SET_REG32(mmws, 0xa4) 1863 CASE_SET_REG32(sfs, 0xa8) 1864 CASE_SET_REG32(drs, 0xac) 1865 CASE_SET_REG32(sbms, 0xb0) 1866 CASE_SET_REG32(dbms, 0xb4) 1867 CASE_SET_REG32(dnad64, 0xb8) 1868 CASE_SET_REG32(pmjad1, 0xc0) 1869 CASE_SET_REG32(pmjad2, 0xc4) 1870 CASE_SET_REG32(rbc, 0xc8) 1871 CASE_SET_REG32(ua, 0xcc) 1872 CASE_SET_REG32(ia, 0xd4) 1873 CASE_SET_REG32(sbc, 0xd8) 1874 CASE_SET_REG32(csbc, 0xdc) 1875 default: 1876 if (offset >= 0x5c && offset < 0xa0) { 1877 int n; 1878 int shift; 1879 n = (offset - 0x58) >> 2; 1880 shift = (offset & 3) * 8; 1881 s->scratch[n] = deposit32(s->scratch[n], shift, 8, val); 1882 } else { 1883 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val); 1884 } 1885 } 1886 #undef CASE_SET_REG24 1887 #undef CASE_SET_REG32 1888 } 1889 1890 static void lsi_mmio_write(void *opaque, hwaddr addr, 1891 uint64_t val, unsigned size) 1892 { 1893 LSIState *s = opaque; 1894 1895 lsi_reg_writeb(s, addr & 0xff, val); 1896 } 1897 1898 static uint64_t lsi_mmio_read(void *opaque, hwaddr addr, 1899 unsigned size) 1900 { 1901 LSIState *s = opaque; 1902 1903 return lsi_reg_readb(s, addr & 0xff); 1904 } 1905 1906 static const MemoryRegionOps lsi_mmio_ops = { 1907 .read = lsi_mmio_read, 1908 .write = lsi_mmio_write, 1909 .endianness = DEVICE_NATIVE_ENDIAN, 1910 .impl = { 1911 .min_access_size = 1, 1912 .max_access_size = 1, 1913 }, 1914 }; 1915 1916 static void lsi_ram_write(void *opaque, hwaddr addr, 1917 uint64_t val, unsigned size) 1918 { 1919 LSIState *s = opaque; 1920 uint32_t newval; 1921 uint32_t mask; 1922 int shift; 1923 1924 newval = s->script_ram[addr >> 2]; 1925 shift = (addr & 3) * 8; 1926 mask = ((uint64_t)1 << (size * 8)) - 1; 1927 newval &= ~(mask << shift); 1928 newval |= val << shift; 1929 s->script_ram[addr >> 2] = newval; 1930 } 1931 1932 static uint64_t lsi_ram_read(void *opaque, hwaddr addr, 1933 unsigned size) 1934 { 1935 LSIState *s = opaque; 1936 uint32_t val; 1937 uint32_t mask; 1938 1939 val = s->script_ram[addr >> 2]; 1940 mask = ((uint64_t)1 << (size * 8)) - 1; 1941 val >>= (addr & 3) * 8; 1942 return val & mask; 1943 } 1944 1945 static const MemoryRegionOps lsi_ram_ops = { 1946 .read = lsi_ram_read, 1947 .write = lsi_ram_write, 1948 .endianness = DEVICE_NATIVE_ENDIAN, 1949 }; 1950 1951 static uint64_t lsi_io_read(void *opaque, hwaddr addr, 1952 unsigned size) 1953 { 1954 LSIState *s = opaque; 1955 return lsi_reg_readb(s, addr & 0xff); 1956 } 1957 1958 static void lsi_io_write(void *opaque, hwaddr addr, 1959 uint64_t val, unsigned size) 1960 { 1961 LSIState *s = opaque; 1962 lsi_reg_writeb(s, addr & 0xff, val); 1963 } 1964 1965 static const MemoryRegionOps lsi_io_ops = { 1966 .read = lsi_io_read, 1967 .write = lsi_io_write, 1968 .endianness = DEVICE_NATIVE_ENDIAN, 1969 .impl = { 1970 .min_access_size = 1, 1971 .max_access_size = 1, 1972 }, 1973 }; 1974 1975 static void lsi_scsi_reset(DeviceState *dev) 1976 { 1977 LSIState *s = LSI53C895A(dev); 1978 1979 lsi_soft_reset(s); 1980 } 1981 1982 static void lsi_pre_save(void *opaque) 1983 { 1984 LSIState *s = opaque; 1985 1986 if (s->current) { 1987 assert(s->current->dma_buf == NULL); 1988 assert(s->current->dma_len == 0); 1989 } 1990 assert(QTAILQ_EMPTY(&s->queue)); 1991 } 1992 1993 static const VMStateDescription vmstate_lsi_scsi = { 1994 .name = "lsiscsi", 1995 .version_id = 0, 1996 .minimum_version_id = 0, 1997 .pre_save = lsi_pre_save, 1998 .fields = (VMStateField[]) { 1999 VMSTATE_PCI_DEVICE(parent_obj, LSIState), 2000 2001 VMSTATE_INT32(carry, LSIState), 2002 VMSTATE_INT32(status, LSIState), 2003 VMSTATE_INT32(msg_action, LSIState), 2004 VMSTATE_INT32(msg_len, LSIState), 2005 VMSTATE_BUFFER(msg, LSIState), 2006 VMSTATE_INT32(waiting, LSIState), 2007 2008 VMSTATE_UINT32(dsa, LSIState), 2009 VMSTATE_UINT32(temp, LSIState), 2010 VMSTATE_UINT32(dnad, LSIState), 2011 VMSTATE_UINT32(dbc, LSIState), 2012 VMSTATE_UINT8(istat0, LSIState), 2013 VMSTATE_UINT8(istat1, LSIState), 2014 VMSTATE_UINT8(dcmd, LSIState), 2015 VMSTATE_UINT8(dstat, LSIState), 2016 VMSTATE_UINT8(dien, LSIState), 2017 VMSTATE_UINT8(sist0, LSIState), 2018 VMSTATE_UINT8(sist1, LSIState), 2019 VMSTATE_UINT8(sien0, LSIState), 2020 VMSTATE_UINT8(sien1, LSIState), 2021 VMSTATE_UINT8(mbox0, LSIState), 2022 VMSTATE_UINT8(mbox1, LSIState), 2023 VMSTATE_UINT8(dfifo, LSIState), 2024 VMSTATE_UINT8(ctest2, LSIState), 2025 VMSTATE_UINT8(ctest3, LSIState), 2026 VMSTATE_UINT8(ctest4, LSIState), 2027 VMSTATE_UINT8(ctest5, LSIState), 2028 VMSTATE_UINT8(ccntl0, LSIState), 2029 VMSTATE_UINT8(ccntl1, LSIState), 2030 VMSTATE_UINT32(dsp, LSIState), 2031 VMSTATE_UINT32(dsps, LSIState), 2032 VMSTATE_UINT8(dmode, LSIState), 2033 VMSTATE_UINT8(dcntl, LSIState), 2034 VMSTATE_UINT8(scntl0, LSIState), 2035 VMSTATE_UINT8(scntl1, LSIState), 2036 VMSTATE_UINT8(scntl2, LSIState), 2037 VMSTATE_UINT8(scntl3, LSIState), 2038 VMSTATE_UINT8(sstat0, LSIState), 2039 VMSTATE_UINT8(sstat1, LSIState), 2040 VMSTATE_UINT8(scid, LSIState), 2041 VMSTATE_UINT8(sxfer, LSIState), 2042 VMSTATE_UINT8(socl, LSIState), 2043 VMSTATE_UINT8(sdid, LSIState), 2044 VMSTATE_UINT8(ssid, LSIState), 2045 VMSTATE_UINT8(sfbr, LSIState), 2046 VMSTATE_UINT8(stest1, LSIState), 2047 VMSTATE_UINT8(stest2, LSIState), 2048 VMSTATE_UINT8(stest3, LSIState), 2049 VMSTATE_UINT8(sidl, LSIState), 2050 VMSTATE_UINT8(stime0, LSIState), 2051 VMSTATE_UINT8(respid0, LSIState), 2052 VMSTATE_UINT8(respid1, LSIState), 2053 VMSTATE_UINT32(mmrs, LSIState), 2054 VMSTATE_UINT32(mmws, LSIState), 2055 VMSTATE_UINT32(sfs, LSIState), 2056 VMSTATE_UINT32(drs, LSIState), 2057 VMSTATE_UINT32(sbms, LSIState), 2058 VMSTATE_UINT32(dbms, LSIState), 2059 VMSTATE_UINT32(dnad64, LSIState), 2060 VMSTATE_UINT32(pmjad1, LSIState), 2061 VMSTATE_UINT32(pmjad2, LSIState), 2062 VMSTATE_UINT32(rbc, LSIState), 2063 VMSTATE_UINT32(ua, LSIState), 2064 VMSTATE_UINT32(ia, LSIState), 2065 VMSTATE_UINT32(sbc, LSIState), 2066 VMSTATE_UINT32(csbc, LSIState), 2067 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)), 2068 VMSTATE_UINT8(sbr, LSIState), 2069 2070 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)), 2071 VMSTATE_END_OF_LIST() 2072 } 2073 }; 2074 2075 static void lsi_scsi_uninit(PCIDevice *d) 2076 { 2077 LSIState *s = LSI53C895A(d); 2078 2079 memory_region_destroy(&s->mmio_io); 2080 memory_region_destroy(&s->ram_io); 2081 memory_region_destroy(&s->io_io); 2082 } 2083 2084 static const struct SCSIBusInfo lsi_scsi_info = { 2085 .tcq = true, 2086 .max_target = LSI_MAX_DEVS, 2087 .max_lun = 0, /* LUN support is buggy */ 2088 2089 .transfer_data = lsi_transfer_data, 2090 .complete = lsi_command_complete, 2091 .cancel = lsi_request_cancelled 2092 }; 2093 2094 static int lsi_scsi_init(PCIDevice *dev) 2095 { 2096 LSIState *s = LSI53C895A(dev); 2097 DeviceState *d = DEVICE(dev); 2098 uint8_t *pci_conf; 2099 Error *err = NULL; 2100 2101 pci_conf = dev->config; 2102 2103 /* PCI latency timer = 255 */ 2104 pci_conf[PCI_LATENCY_TIMER] = 0xff; 2105 /* Interrupt pin A */ 2106 pci_conf[PCI_INTERRUPT_PIN] = 0x01; 2107 2108 memory_region_init_io(&s->mmio_io, OBJECT(s), &lsi_mmio_ops, s, 2109 "lsi-mmio", 0x400); 2110 memory_region_init_io(&s->ram_io, OBJECT(s), &lsi_ram_ops, s, 2111 "lsi-ram", 0x2000); 2112 memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s, 2113 "lsi-io", 256); 2114 2115 pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io); 2116 pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mmio_io); 2117 pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io); 2118 QTAILQ_INIT(&s->queue); 2119 2120 scsi_bus_new(&s->bus, sizeof(s->bus), d, &lsi_scsi_info, NULL); 2121 if (!d->hotplugged) { 2122 scsi_bus_legacy_handle_cmdline(&s->bus, &err); 2123 if (err != NULL) { 2124 error_free(err); 2125 return -1; 2126 } 2127 } 2128 return 0; 2129 } 2130 2131 static void lsi_class_init(ObjectClass *klass, void *data) 2132 { 2133 DeviceClass *dc = DEVICE_CLASS(klass); 2134 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 2135 2136 k->init = lsi_scsi_init; 2137 k->exit = lsi_scsi_uninit; 2138 k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC; 2139 k->device_id = PCI_DEVICE_ID_LSI_53C895A; 2140 k->class_id = PCI_CLASS_STORAGE_SCSI; 2141 k->subsystem_id = 0x1000; 2142 dc->reset = lsi_scsi_reset; 2143 dc->vmsd = &vmstate_lsi_scsi; 2144 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 2145 } 2146 2147 static const TypeInfo lsi_info = { 2148 .name = TYPE_LSI53C895A, 2149 .parent = TYPE_PCI_DEVICE, 2150 .instance_size = sizeof(LSIState), 2151 .class_init = lsi_class_init, 2152 }; 2153 2154 static void lsi53c810_class_init(ObjectClass *klass, void *data) 2155 { 2156 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 2157 2158 k->device_id = PCI_DEVICE_ID_LSI_53C810; 2159 } 2160 2161 static TypeInfo lsi53c810_info = { 2162 .name = TYPE_LSI53C810, 2163 .parent = TYPE_LSI53C895A, 2164 .class_init = lsi53c810_class_init, 2165 }; 2166 2167 static void lsi53c895a_register_types(void) 2168 { 2169 type_register_static(&lsi_info); 2170 type_register_static(&lsi53c810_info); 2171 } 2172 2173 type_init(lsi53c895a_register_types) 2174