1 /* 2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation 3 * 4 * Copyright (c) 2006 CodeSourcery. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the LGPL. 8 */ 9 10 /* ??? Need to check if the {read,write}[wl] routines work properly on 11 big-endian targets. */ 12 13 #include <assert.h> 14 15 #include "hw/hw.h" 16 #include "hw/pci/pci.h" 17 #include "hw/scsi/scsi.h" 18 #include "sysemu/dma.h" 19 20 //#define DEBUG_LSI 21 //#define DEBUG_LSI_REG 22 23 #ifdef DEBUG_LSI 24 #define DPRINTF(fmt, ...) \ 25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0) 26 #define BADF(fmt, ...) \ 27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0) 28 #else 29 #define DPRINTF(fmt, ...) do {} while(0) 30 #define BADF(fmt, ...) \ 31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0) 32 #endif 33 34 #define LSI_MAX_DEVS 7 35 36 #define LSI_SCNTL0_TRG 0x01 37 #define LSI_SCNTL0_AAP 0x02 38 #define LSI_SCNTL0_EPC 0x08 39 #define LSI_SCNTL0_WATN 0x10 40 #define LSI_SCNTL0_START 0x20 41 42 #define LSI_SCNTL1_SST 0x01 43 #define LSI_SCNTL1_IARB 0x02 44 #define LSI_SCNTL1_AESP 0x04 45 #define LSI_SCNTL1_RST 0x08 46 #define LSI_SCNTL1_CON 0x10 47 #define LSI_SCNTL1_DHP 0x20 48 #define LSI_SCNTL1_ADB 0x40 49 #define LSI_SCNTL1_EXC 0x80 50 51 #define LSI_SCNTL2_WSR 0x01 52 #define LSI_SCNTL2_VUE0 0x02 53 #define LSI_SCNTL2_VUE1 0x04 54 #define LSI_SCNTL2_WSS 0x08 55 #define LSI_SCNTL2_SLPHBEN 0x10 56 #define LSI_SCNTL2_SLPMD 0x20 57 #define LSI_SCNTL2_CHM 0x40 58 #define LSI_SCNTL2_SDU 0x80 59 60 #define LSI_ISTAT0_DIP 0x01 61 #define LSI_ISTAT0_SIP 0x02 62 #define LSI_ISTAT0_INTF 0x04 63 #define LSI_ISTAT0_CON 0x08 64 #define LSI_ISTAT0_SEM 0x10 65 #define LSI_ISTAT0_SIGP 0x20 66 #define LSI_ISTAT0_SRST 0x40 67 #define LSI_ISTAT0_ABRT 0x80 68 69 #define LSI_ISTAT1_SI 0x01 70 #define LSI_ISTAT1_SRUN 0x02 71 #define LSI_ISTAT1_FLSH 0x04 72 73 #define LSI_SSTAT0_SDP0 0x01 74 #define LSI_SSTAT0_RST 0x02 75 #define LSI_SSTAT0_WOA 0x04 76 #define LSI_SSTAT0_LOA 0x08 77 #define LSI_SSTAT0_AIP 0x10 78 #define LSI_SSTAT0_OLF 0x20 79 #define LSI_SSTAT0_ORF 0x40 80 #define LSI_SSTAT0_ILF 0x80 81 82 #define LSI_SIST0_PAR 0x01 83 #define LSI_SIST0_RST 0x02 84 #define LSI_SIST0_UDC 0x04 85 #define LSI_SIST0_SGE 0x08 86 #define LSI_SIST0_RSL 0x10 87 #define LSI_SIST0_SEL 0x20 88 #define LSI_SIST0_CMP 0x40 89 #define LSI_SIST0_MA 0x80 90 91 #define LSI_SIST1_HTH 0x01 92 #define LSI_SIST1_GEN 0x02 93 #define LSI_SIST1_STO 0x04 94 #define LSI_SIST1_SBMC 0x10 95 96 #define LSI_SOCL_IO 0x01 97 #define LSI_SOCL_CD 0x02 98 #define LSI_SOCL_MSG 0x04 99 #define LSI_SOCL_ATN 0x08 100 #define LSI_SOCL_SEL 0x10 101 #define LSI_SOCL_BSY 0x20 102 #define LSI_SOCL_ACK 0x40 103 #define LSI_SOCL_REQ 0x80 104 105 #define LSI_DSTAT_IID 0x01 106 #define LSI_DSTAT_SIR 0x04 107 #define LSI_DSTAT_SSI 0x08 108 #define LSI_DSTAT_ABRT 0x10 109 #define LSI_DSTAT_BF 0x20 110 #define LSI_DSTAT_MDPE 0x40 111 #define LSI_DSTAT_DFE 0x80 112 113 #define LSI_DCNTL_COM 0x01 114 #define LSI_DCNTL_IRQD 0x02 115 #define LSI_DCNTL_STD 0x04 116 #define LSI_DCNTL_IRQM 0x08 117 #define LSI_DCNTL_SSM 0x10 118 #define LSI_DCNTL_PFEN 0x20 119 #define LSI_DCNTL_PFF 0x40 120 #define LSI_DCNTL_CLSE 0x80 121 122 #define LSI_DMODE_MAN 0x01 123 #define LSI_DMODE_BOF 0x02 124 #define LSI_DMODE_ERMP 0x04 125 #define LSI_DMODE_ERL 0x08 126 #define LSI_DMODE_DIOM 0x10 127 #define LSI_DMODE_SIOM 0x20 128 129 #define LSI_CTEST2_DACK 0x01 130 #define LSI_CTEST2_DREQ 0x02 131 #define LSI_CTEST2_TEOP 0x04 132 #define LSI_CTEST2_PCICIE 0x08 133 #define LSI_CTEST2_CM 0x10 134 #define LSI_CTEST2_CIO 0x20 135 #define LSI_CTEST2_SIGP 0x40 136 #define LSI_CTEST2_DDIR 0x80 137 138 #define LSI_CTEST5_BL2 0x04 139 #define LSI_CTEST5_DDIR 0x08 140 #define LSI_CTEST5_MASR 0x10 141 #define LSI_CTEST5_DFSN 0x20 142 #define LSI_CTEST5_BBCK 0x40 143 #define LSI_CTEST5_ADCK 0x80 144 145 #define LSI_CCNTL0_DILS 0x01 146 #define LSI_CCNTL0_DISFC 0x10 147 #define LSI_CCNTL0_ENNDJ 0x20 148 #define LSI_CCNTL0_PMJCTL 0x40 149 #define LSI_CCNTL0_ENPMJ 0x80 150 151 #define LSI_CCNTL1_EN64DBMV 0x01 152 #define LSI_CCNTL1_EN64TIBMV 0x02 153 #define LSI_CCNTL1_64TIMOD 0x04 154 #define LSI_CCNTL1_DDAC 0x08 155 #define LSI_CCNTL1_ZMOD 0x80 156 157 /* Enable Response to Reselection */ 158 #define LSI_SCID_RRE 0x60 159 160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD) 161 162 #define PHASE_DO 0 163 #define PHASE_DI 1 164 #define PHASE_CMD 2 165 #define PHASE_ST 3 166 #define PHASE_MO 6 167 #define PHASE_MI 7 168 #define PHASE_MASK 7 169 170 /* Maximum length of MSG IN data. */ 171 #define LSI_MAX_MSGIN_LEN 8 172 173 /* Flag set if this is a tagged command. */ 174 #define LSI_TAG_VALID (1 << 16) 175 176 typedef struct lsi_request { 177 SCSIRequest *req; 178 uint32_t tag; 179 uint32_t dma_len; 180 uint8_t *dma_buf; 181 uint32_t pending; 182 int out; 183 QTAILQ_ENTRY(lsi_request) next; 184 } lsi_request; 185 186 typedef struct { 187 /*< private >*/ 188 PCIDevice parent_obj; 189 /*< public >*/ 190 191 MemoryRegion mmio_io; 192 MemoryRegion ram_io; 193 MemoryRegion io_io; 194 195 int carry; /* ??? Should this be an a visible register somewhere? */ 196 int status; 197 /* Action to take at the end of a MSG IN phase. 198 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */ 199 int msg_action; 200 int msg_len; 201 uint8_t msg[LSI_MAX_MSGIN_LEN]; 202 /* 0 if SCRIPTS are running or stopped. 203 * 1 if a Wait Reselect instruction has been issued. 204 * 2 if processing DMA from lsi_execute_script. 205 * 3 if a DMA operation is in progress. */ 206 int waiting; 207 SCSIBus bus; 208 int current_lun; 209 /* The tag is a combination of the device ID and the SCSI tag. */ 210 uint32_t select_tag; 211 int command_complete; 212 QTAILQ_HEAD(, lsi_request) queue; 213 lsi_request *current; 214 215 uint32_t dsa; 216 uint32_t temp; 217 uint32_t dnad; 218 uint32_t dbc; 219 uint8_t istat0; 220 uint8_t istat1; 221 uint8_t dcmd; 222 uint8_t dstat; 223 uint8_t dien; 224 uint8_t sist0; 225 uint8_t sist1; 226 uint8_t sien0; 227 uint8_t sien1; 228 uint8_t mbox0; 229 uint8_t mbox1; 230 uint8_t dfifo; 231 uint8_t ctest2; 232 uint8_t ctest3; 233 uint8_t ctest4; 234 uint8_t ctest5; 235 uint8_t ccntl0; 236 uint8_t ccntl1; 237 uint32_t dsp; 238 uint32_t dsps; 239 uint8_t dmode; 240 uint8_t dcntl; 241 uint8_t scntl0; 242 uint8_t scntl1; 243 uint8_t scntl2; 244 uint8_t scntl3; 245 uint8_t sstat0; 246 uint8_t sstat1; 247 uint8_t scid; 248 uint8_t sxfer; 249 uint8_t socl; 250 uint8_t sdid; 251 uint8_t ssid; 252 uint8_t sfbr; 253 uint8_t stest1; 254 uint8_t stest2; 255 uint8_t stest3; 256 uint8_t sidl; 257 uint8_t stime0; 258 uint8_t respid0; 259 uint8_t respid1; 260 uint32_t mmrs; 261 uint32_t mmws; 262 uint32_t sfs; 263 uint32_t drs; 264 uint32_t sbms; 265 uint32_t dbms; 266 uint32_t dnad64; 267 uint32_t pmjad1; 268 uint32_t pmjad2; 269 uint32_t rbc; 270 uint32_t ua; 271 uint32_t ia; 272 uint32_t sbc; 273 uint32_t csbc; 274 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */ 275 uint8_t sbr; 276 277 /* Script ram is stored as 32-bit words in host byteorder. */ 278 uint32_t script_ram[2048]; 279 } LSIState; 280 281 #define TYPE_LSI53C895A "lsi53c895a" 282 283 #define LSI53C895A(obj) \ 284 OBJECT_CHECK(LSIState, (obj), TYPE_LSI53C895A) 285 286 static inline int lsi_irq_on_rsl(LSIState *s) 287 { 288 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE); 289 } 290 291 static void lsi_soft_reset(LSIState *s) 292 { 293 DPRINTF("Reset\n"); 294 s->carry = 0; 295 296 s->msg_action = 0; 297 s->msg_len = 0; 298 s->waiting = 0; 299 s->dsa = 0; 300 s->dnad = 0; 301 s->dbc = 0; 302 s->temp = 0; 303 memset(s->scratch, 0, sizeof(s->scratch)); 304 s->istat0 = 0; 305 s->istat1 = 0; 306 s->dcmd = 0x40; 307 s->dstat = LSI_DSTAT_DFE; 308 s->dien = 0; 309 s->sist0 = 0; 310 s->sist1 = 0; 311 s->sien0 = 0; 312 s->sien1 = 0; 313 s->mbox0 = 0; 314 s->mbox1 = 0; 315 s->dfifo = 0; 316 s->ctest2 = LSI_CTEST2_DACK; 317 s->ctest3 = 0; 318 s->ctest4 = 0; 319 s->ctest5 = 0; 320 s->ccntl0 = 0; 321 s->ccntl1 = 0; 322 s->dsp = 0; 323 s->dsps = 0; 324 s->dmode = 0; 325 s->dcntl = 0; 326 s->scntl0 = 0xc0; 327 s->scntl1 = 0; 328 s->scntl2 = 0; 329 s->scntl3 = 0; 330 s->sstat0 = 0; 331 s->sstat1 = 0; 332 s->scid = 7; 333 s->sxfer = 0; 334 s->socl = 0; 335 s->sdid = 0; 336 s->ssid = 0; 337 s->stest1 = 0; 338 s->stest2 = 0; 339 s->stest3 = 0; 340 s->sidl = 0; 341 s->stime0 = 0; 342 s->respid0 = 0x80; 343 s->respid1 = 0; 344 s->mmrs = 0; 345 s->mmws = 0; 346 s->sfs = 0; 347 s->drs = 0; 348 s->sbms = 0; 349 s->dbms = 0; 350 s->dnad64 = 0; 351 s->pmjad1 = 0; 352 s->pmjad2 = 0; 353 s->rbc = 0; 354 s->ua = 0; 355 s->ia = 0; 356 s->sbc = 0; 357 s->csbc = 0; 358 s->sbr = 0; 359 assert(QTAILQ_EMPTY(&s->queue)); 360 assert(!s->current); 361 } 362 363 static int lsi_dma_40bit(LSIState *s) 364 { 365 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT) 366 return 1; 367 return 0; 368 } 369 370 static int lsi_dma_ti64bit(LSIState *s) 371 { 372 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV) 373 return 1; 374 return 0; 375 } 376 377 static int lsi_dma_64bit(LSIState *s) 378 { 379 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV) 380 return 1; 381 return 0; 382 } 383 384 static uint8_t lsi_reg_readb(LSIState *s, int offset); 385 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val); 386 static void lsi_execute_script(LSIState *s); 387 static void lsi_reselect(LSIState *s, lsi_request *p); 388 389 static inline uint32_t read_dword(LSIState *s, uint32_t addr) 390 { 391 uint32_t buf; 392 393 pci_dma_read(PCI_DEVICE(s), addr, &buf, 4); 394 return cpu_to_le32(buf); 395 } 396 397 static void lsi_stop_script(LSIState *s) 398 { 399 s->istat1 &= ~LSI_ISTAT1_SRUN; 400 } 401 402 static void lsi_update_irq(LSIState *s) 403 { 404 PCIDevice *d = PCI_DEVICE(s); 405 int level; 406 static int last_level; 407 lsi_request *p; 408 409 /* It's unclear whether the DIP/SIP bits should be cleared when the 410 Interrupt Status Registers are cleared or when istat0 is read. 411 We currently do the formwer, which seems to work. */ 412 level = 0; 413 if (s->dstat) { 414 if (s->dstat & s->dien) 415 level = 1; 416 s->istat0 |= LSI_ISTAT0_DIP; 417 } else { 418 s->istat0 &= ~LSI_ISTAT0_DIP; 419 } 420 421 if (s->sist0 || s->sist1) { 422 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1)) 423 level = 1; 424 s->istat0 |= LSI_ISTAT0_SIP; 425 } else { 426 s->istat0 &= ~LSI_ISTAT0_SIP; 427 } 428 if (s->istat0 & LSI_ISTAT0_INTF) 429 level = 1; 430 431 if (level != last_level) { 432 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n", 433 level, s->dstat, s->sist1, s->sist0); 434 last_level = level; 435 } 436 qemu_set_irq(d->irq[0], level); 437 438 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) { 439 DPRINTF("Handled IRQs & disconnected, looking for pending " 440 "processes\n"); 441 QTAILQ_FOREACH(p, &s->queue, next) { 442 if (p->pending) { 443 lsi_reselect(s, p); 444 break; 445 } 446 } 447 } 448 } 449 450 /* Stop SCRIPTS execution and raise a SCSI interrupt. */ 451 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1) 452 { 453 uint32_t mask0; 454 uint32_t mask1; 455 456 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n", 457 stat1, stat0, s->sist1, s->sist0); 458 s->sist0 |= stat0; 459 s->sist1 |= stat1; 460 /* Stop processor on fatal or unmasked interrupt. As a special hack 461 we don't stop processing when raising STO. Instead continue 462 execution and stop at the next insn that accesses the SCSI bus. */ 463 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL); 464 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH); 465 mask1 &= ~LSI_SIST1_STO; 466 if (s->sist0 & mask0 || s->sist1 & mask1) { 467 lsi_stop_script(s); 468 } 469 lsi_update_irq(s); 470 } 471 472 /* Stop SCRIPTS execution and raise a DMA interrupt. */ 473 static void lsi_script_dma_interrupt(LSIState *s, int stat) 474 { 475 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat); 476 s->dstat |= stat; 477 lsi_update_irq(s); 478 lsi_stop_script(s); 479 } 480 481 static inline void lsi_set_phase(LSIState *s, int phase) 482 { 483 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase; 484 } 485 486 static void lsi_bad_phase(LSIState *s, int out, int new_phase) 487 { 488 /* Trigger a phase mismatch. */ 489 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) { 490 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) { 491 s->dsp = out ? s->pmjad1 : s->pmjad2; 492 } else { 493 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1); 494 } 495 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp); 496 } else { 497 DPRINTF("Phase mismatch interrupt\n"); 498 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0); 499 lsi_stop_script(s); 500 } 501 lsi_set_phase(s, new_phase); 502 } 503 504 505 /* Resume SCRIPTS execution after a DMA operation. */ 506 static void lsi_resume_script(LSIState *s) 507 { 508 if (s->waiting != 2) { 509 s->waiting = 0; 510 lsi_execute_script(s); 511 } else { 512 s->waiting = 0; 513 } 514 } 515 516 static void lsi_disconnect(LSIState *s) 517 { 518 s->scntl1 &= ~LSI_SCNTL1_CON; 519 s->sstat1 &= ~PHASE_MASK; 520 } 521 522 static void lsi_bad_selection(LSIState *s, uint32_t id) 523 { 524 DPRINTF("Selected absent target %d\n", id); 525 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO); 526 lsi_disconnect(s); 527 } 528 529 /* Initiate a SCSI layer data transfer. */ 530 static void lsi_do_dma(LSIState *s, int out) 531 { 532 PCIDevice *pci_dev; 533 uint32_t count; 534 dma_addr_t addr; 535 SCSIDevice *dev; 536 537 assert(s->current); 538 if (!s->current->dma_len) { 539 /* Wait until data is available. */ 540 DPRINTF("DMA no data available\n"); 541 return; 542 } 543 544 pci_dev = PCI_DEVICE(s); 545 dev = s->current->req->dev; 546 assert(dev); 547 548 count = s->dbc; 549 if (count > s->current->dma_len) 550 count = s->current->dma_len; 551 552 addr = s->dnad; 553 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */ 554 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s)) 555 addr |= ((uint64_t)s->dnad64 << 32); 556 else if (s->dbms) 557 addr |= ((uint64_t)s->dbms << 32); 558 else if (s->sbms) 559 addr |= ((uint64_t)s->sbms << 32); 560 561 DPRINTF("DMA addr=0x" DMA_ADDR_FMT " len=%d\n", addr, count); 562 s->csbc += count; 563 s->dnad += count; 564 s->dbc -= count; 565 if (s->current->dma_buf == NULL) { 566 s->current->dma_buf = scsi_req_get_buf(s->current->req); 567 } 568 /* ??? Set SFBR to first data byte. */ 569 if (out) { 570 pci_dma_read(pci_dev, addr, s->current->dma_buf, count); 571 } else { 572 pci_dma_write(pci_dev, addr, s->current->dma_buf, count); 573 } 574 s->current->dma_len -= count; 575 if (s->current->dma_len == 0) { 576 s->current->dma_buf = NULL; 577 scsi_req_continue(s->current->req); 578 } else { 579 s->current->dma_buf += count; 580 lsi_resume_script(s); 581 } 582 } 583 584 585 /* Add a command to the queue. */ 586 static void lsi_queue_command(LSIState *s) 587 { 588 lsi_request *p = s->current; 589 590 DPRINTF("Queueing tag=0x%x\n", p->tag); 591 assert(s->current != NULL); 592 assert(s->current->dma_len == 0); 593 QTAILQ_INSERT_TAIL(&s->queue, s->current, next); 594 s->current = NULL; 595 596 p->pending = 0; 597 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO; 598 } 599 600 /* Queue a byte for a MSG IN phase. */ 601 static void lsi_add_msg_byte(LSIState *s, uint8_t data) 602 { 603 if (s->msg_len >= LSI_MAX_MSGIN_LEN) { 604 BADF("MSG IN data too long\n"); 605 } else { 606 DPRINTF("MSG IN 0x%02x\n", data); 607 s->msg[s->msg_len++] = data; 608 } 609 } 610 611 /* Perform reselection to continue a command. */ 612 static void lsi_reselect(LSIState *s, lsi_request *p) 613 { 614 int id; 615 616 assert(s->current == NULL); 617 QTAILQ_REMOVE(&s->queue, p, next); 618 s->current = p; 619 620 id = (p->tag >> 8) & 0xf; 621 s->ssid = id | 0x80; 622 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */ 623 if (!(s->dcntl & LSI_DCNTL_COM)) { 624 s->sfbr = 1 << (id & 0x7); 625 } 626 DPRINTF("Reselected target %d\n", id); 627 s->scntl1 |= LSI_SCNTL1_CON; 628 lsi_set_phase(s, PHASE_MI); 629 s->msg_action = p->out ? 2 : 3; 630 s->current->dma_len = p->pending; 631 lsi_add_msg_byte(s, 0x80); 632 if (s->current->tag & LSI_TAG_VALID) { 633 lsi_add_msg_byte(s, 0x20); 634 lsi_add_msg_byte(s, p->tag & 0xff); 635 } 636 637 if (lsi_irq_on_rsl(s)) { 638 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0); 639 } 640 } 641 642 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag) 643 { 644 lsi_request *p; 645 646 QTAILQ_FOREACH(p, &s->queue, next) { 647 if (p->tag == tag) { 648 return p; 649 } 650 } 651 652 return NULL; 653 } 654 655 static void lsi_request_free(LSIState *s, lsi_request *p) 656 { 657 if (p == s->current) { 658 s->current = NULL; 659 } else { 660 QTAILQ_REMOVE(&s->queue, p, next); 661 } 662 g_free(p); 663 } 664 665 static void lsi_request_cancelled(SCSIRequest *req) 666 { 667 LSIState *s = LSI53C895A(req->bus->qbus.parent); 668 lsi_request *p = req->hba_private; 669 670 req->hba_private = NULL; 671 lsi_request_free(s, p); 672 scsi_req_unref(req); 673 } 674 675 /* Record that data is available for a queued command. Returns zero if 676 the device was reselected, nonzero if the IO is deferred. */ 677 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len) 678 { 679 lsi_request *p = req->hba_private; 680 681 if (p->pending) { 682 BADF("Multiple IO pending for request %p\n", p); 683 } 684 p->pending = len; 685 /* Reselect if waiting for it, or if reselection triggers an IRQ 686 and the bus is free. 687 Since no interrupt stacking is implemented in the emulation, it 688 is also required that there are no pending interrupts waiting 689 for service from the device driver. */ 690 if (s->waiting == 1 || 691 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) && 692 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) { 693 /* Reselect device. */ 694 lsi_reselect(s, p); 695 return 0; 696 } else { 697 DPRINTF("Queueing IO tag=0x%x\n", p->tag); 698 p->pending = len; 699 return 1; 700 } 701 } 702 703 /* Callback to indicate that the SCSI layer has completed a command. */ 704 static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid) 705 { 706 LSIState *s = LSI53C895A(req->bus->qbus.parent); 707 int out; 708 709 out = (s->sstat1 & PHASE_MASK) == PHASE_DO; 710 DPRINTF("Command complete status=%d\n", (int)status); 711 s->status = status; 712 s->command_complete = 2; 713 if (s->waiting && s->dbc != 0) { 714 /* Raise phase mismatch for short transfers. */ 715 lsi_bad_phase(s, out, PHASE_ST); 716 } else { 717 lsi_set_phase(s, PHASE_ST); 718 } 719 720 if (req->hba_private == s->current) { 721 req->hba_private = NULL; 722 lsi_request_free(s, s->current); 723 scsi_req_unref(req); 724 } 725 lsi_resume_script(s); 726 } 727 728 /* Callback to indicate that the SCSI layer has completed a transfer. */ 729 static void lsi_transfer_data(SCSIRequest *req, uint32_t len) 730 { 731 LSIState *s = LSI53C895A(req->bus->qbus.parent); 732 int out; 733 734 assert(req->hba_private); 735 if (s->waiting == 1 || req->hba_private != s->current || 736 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) { 737 if (lsi_queue_req(s, req, len)) { 738 return; 739 } 740 } 741 742 out = (s->sstat1 & PHASE_MASK) == PHASE_DO; 743 744 /* host adapter (re)connected */ 745 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len); 746 s->current->dma_len = len; 747 s->command_complete = 1; 748 if (s->waiting) { 749 if (s->waiting == 1 || s->dbc == 0) { 750 lsi_resume_script(s); 751 } else { 752 lsi_do_dma(s, out); 753 } 754 } 755 } 756 757 static void lsi_do_command(LSIState *s) 758 { 759 SCSIDevice *dev; 760 uint8_t buf[16]; 761 uint32_t id; 762 int n; 763 764 DPRINTF("Send command len=%d\n", s->dbc); 765 if (s->dbc > 16) 766 s->dbc = 16; 767 pci_dma_read(PCI_DEVICE(s), s->dnad, buf, s->dbc); 768 s->sfbr = buf[0]; 769 s->command_complete = 0; 770 771 id = (s->select_tag >> 8) & 0xf; 772 dev = scsi_device_find(&s->bus, 0, id, s->current_lun); 773 if (!dev) { 774 lsi_bad_selection(s, id); 775 return; 776 } 777 778 assert(s->current == NULL); 779 s->current = g_malloc0(sizeof(lsi_request)); 780 s->current->tag = s->select_tag; 781 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf, 782 s->current); 783 784 n = scsi_req_enqueue(s->current->req); 785 if (n) { 786 if (n > 0) { 787 lsi_set_phase(s, PHASE_DI); 788 } else if (n < 0) { 789 lsi_set_phase(s, PHASE_DO); 790 } 791 scsi_req_continue(s->current->req); 792 } 793 if (!s->command_complete) { 794 if (n) { 795 /* Command did not complete immediately so disconnect. */ 796 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */ 797 lsi_add_msg_byte(s, 4); /* DISCONNECT */ 798 /* wait data */ 799 lsi_set_phase(s, PHASE_MI); 800 s->msg_action = 1; 801 lsi_queue_command(s); 802 } else { 803 /* wait command complete */ 804 lsi_set_phase(s, PHASE_DI); 805 } 806 } 807 } 808 809 static void lsi_do_status(LSIState *s) 810 { 811 uint8_t status; 812 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status); 813 if (s->dbc != 1) 814 BADF("Bad Status move\n"); 815 s->dbc = 1; 816 status = s->status; 817 s->sfbr = status; 818 pci_dma_write(PCI_DEVICE(s), s->dnad, &status, 1); 819 lsi_set_phase(s, PHASE_MI); 820 s->msg_action = 1; 821 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */ 822 } 823 824 static void lsi_do_msgin(LSIState *s) 825 { 826 int len; 827 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len); 828 s->sfbr = s->msg[0]; 829 len = s->msg_len; 830 if (len > s->dbc) 831 len = s->dbc; 832 pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len); 833 /* Linux drivers rely on the last byte being in the SIDL. */ 834 s->sidl = s->msg[len - 1]; 835 s->msg_len -= len; 836 if (s->msg_len) { 837 memmove(s->msg, s->msg + len, s->msg_len); 838 } else { 839 /* ??? Check if ATN (not yet implemented) is asserted and maybe 840 switch to PHASE_MO. */ 841 switch (s->msg_action) { 842 case 0: 843 lsi_set_phase(s, PHASE_CMD); 844 break; 845 case 1: 846 lsi_disconnect(s); 847 break; 848 case 2: 849 lsi_set_phase(s, PHASE_DO); 850 break; 851 case 3: 852 lsi_set_phase(s, PHASE_DI); 853 break; 854 default: 855 abort(); 856 } 857 } 858 } 859 860 /* Read the next byte during a MSGOUT phase. */ 861 static uint8_t lsi_get_msgbyte(LSIState *s) 862 { 863 uint8_t data; 864 pci_dma_read(PCI_DEVICE(s), s->dnad, &data, 1); 865 s->dnad++; 866 s->dbc--; 867 return data; 868 } 869 870 /* Skip the next n bytes during a MSGOUT phase. */ 871 static void lsi_skip_msgbytes(LSIState *s, unsigned int n) 872 { 873 s->dnad += n; 874 s->dbc -= n; 875 } 876 877 static void lsi_do_msgout(LSIState *s) 878 { 879 uint8_t msg; 880 int len; 881 uint32_t current_tag; 882 lsi_request *current_req, *p, *p_next; 883 884 if (s->current) { 885 current_tag = s->current->tag; 886 current_req = s->current; 887 } else { 888 current_tag = s->select_tag; 889 current_req = lsi_find_by_tag(s, current_tag); 890 } 891 892 DPRINTF("MSG out len=%d\n", s->dbc); 893 while (s->dbc) { 894 msg = lsi_get_msgbyte(s); 895 s->sfbr = msg; 896 897 switch (msg) { 898 case 0x04: 899 DPRINTF("MSG: Disconnect\n"); 900 lsi_disconnect(s); 901 break; 902 case 0x08: 903 DPRINTF("MSG: No Operation\n"); 904 lsi_set_phase(s, PHASE_CMD); 905 break; 906 case 0x01: 907 len = lsi_get_msgbyte(s); 908 msg = lsi_get_msgbyte(s); 909 (void)len; /* avoid a warning about unused variable*/ 910 DPRINTF("Extended message 0x%x (len %d)\n", msg, len); 911 switch (msg) { 912 case 1: 913 DPRINTF("SDTR (ignored)\n"); 914 lsi_skip_msgbytes(s, 2); 915 break; 916 case 3: 917 DPRINTF("WDTR (ignored)\n"); 918 lsi_skip_msgbytes(s, 1); 919 break; 920 default: 921 goto bad; 922 } 923 break; 924 case 0x20: /* SIMPLE queue */ 925 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID; 926 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff); 927 break; 928 case 0x21: /* HEAD of queue */ 929 BADF("HEAD queue not implemented\n"); 930 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID; 931 break; 932 case 0x22: /* ORDERED queue */ 933 BADF("ORDERED queue not implemented\n"); 934 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID; 935 break; 936 case 0x0d: 937 /* The ABORT TAG message clears the current I/O process only. */ 938 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag); 939 if (current_req) { 940 scsi_req_cancel(current_req->req); 941 } 942 lsi_disconnect(s); 943 break; 944 case 0x06: 945 case 0x0e: 946 case 0x0c: 947 /* The ABORT message clears all I/O processes for the selecting 948 initiator on the specified logical unit of the target. */ 949 if (msg == 0x06) { 950 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag); 951 } 952 /* The CLEAR QUEUE message clears all I/O processes for all 953 initiators on the specified logical unit of the target. */ 954 if (msg == 0x0e) { 955 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag); 956 } 957 /* The BUS DEVICE RESET message clears all I/O processes for all 958 initiators on all logical units of the target. */ 959 if (msg == 0x0c) { 960 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag); 961 } 962 963 /* clear the current I/O process */ 964 if (s->current) { 965 scsi_req_cancel(s->current->req); 966 } 967 968 /* As the current implemented devices scsi_disk and scsi_generic 969 only support one LUN, we don't need to keep track of LUNs. 970 Clearing I/O processes for other initiators could be possible 971 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX 972 device, but this is currently not implemented (and seems not 973 to be really necessary). So let's simply clear all queued 974 commands for the current device: */ 975 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) { 976 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) { 977 scsi_req_cancel(p->req); 978 } 979 } 980 981 lsi_disconnect(s); 982 break; 983 default: 984 if ((msg & 0x80) == 0) { 985 goto bad; 986 } 987 s->current_lun = msg & 7; 988 DPRINTF("Select LUN %d\n", s->current_lun); 989 lsi_set_phase(s, PHASE_CMD); 990 break; 991 } 992 } 993 return; 994 bad: 995 BADF("Unimplemented message 0x%02x\n", msg); 996 lsi_set_phase(s, PHASE_MI); 997 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */ 998 s->msg_action = 0; 999 } 1000 1001 #define LSI_BUF_SIZE 4096 1002 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count) 1003 { 1004 PCIDevice *d = PCI_DEVICE(s); 1005 int n; 1006 uint8_t buf[LSI_BUF_SIZE]; 1007 1008 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count); 1009 while (count) { 1010 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count; 1011 pci_dma_read(d, src, buf, n); 1012 pci_dma_write(d, dest, buf, n); 1013 src += n; 1014 dest += n; 1015 count -= n; 1016 } 1017 } 1018 1019 static void lsi_wait_reselect(LSIState *s) 1020 { 1021 lsi_request *p; 1022 1023 DPRINTF("Wait Reselect\n"); 1024 1025 QTAILQ_FOREACH(p, &s->queue, next) { 1026 if (p->pending) { 1027 lsi_reselect(s, p); 1028 break; 1029 } 1030 } 1031 if (s->current == NULL) { 1032 s->waiting = 1; 1033 } 1034 } 1035 1036 static void lsi_execute_script(LSIState *s) 1037 { 1038 PCIDevice *pci_dev = PCI_DEVICE(s); 1039 uint32_t insn; 1040 uint32_t addr, addr_high; 1041 int opcode; 1042 int insn_processed = 0; 1043 1044 s->istat1 |= LSI_ISTAT1_SRUN; 1045 again: 1046 insn_processed++; 1047 insn = read_dword(s, s->dsp); 1048 if (!insn) { 1049 /* If we receive an empty opcode increment the DSP by 4 bytes 1050 instead of 8 and execute the next opcode at that location */ 1051 s->dsp += 4; 1052 goto again; 1053 } 1054 addr = read_dword(s, s->dsp + 4); 1055 addr_high = 0; 1056 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr); 1057 s->dsps = addr; 1058 s->dcmd = insn >> 24; 1059 s->dsp += 8; 1060 switch (insn >> 30) { 1061 case 0: /* Block move. */ 1062 if (s->sist1 & LSI_SIST1_STO) { 1063 DPRINTF("Delayed select timeout\n"); 1064 lsi_stop_script(s); 1065 break; 1066 } 1067 s->dbc = insn & 0xffffff; 1068 s->rbc = s->dbc; 1069 /* ??? Set ESA. */ 1070 s->ia = s->dsp - 8; 1071 if (insn & (1 << 29)) { 1072 /* Indirect addressing. */ 1073 addr = read_dword(s, addr); 1074 } else if (insn & (1 << 28)) { 1075 uint32_t buf[2]; 1076 int32_t offset; 1077 /* Table indirect addressing. */ 1078 1079 /* 32-bit Table indirect */ 1080 offset = sextract32(addr, 0, 24); 1081 pci_dma_read(pci_dev, s->dsa + offset, buf, 8); 1082 /* byte count is stored in bits 0:23 only */ 1083 s->dbc = cpu_to_le32(buf[0]) & 0xffffff; 1084 s->rbc = s->dbc; 1085 addr = cpu_to_le32(buf[1]); 1086 1087 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of 1088 * table, bits [31:24] */ 1089 if (lsi_dma_40bit(s)) 1090 addr_high = cpu_to_le32(buf[0]) >> 24; 1091 else if (lsi_dma_ti64bit(s)) { 1092 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f; 1093 switch (selector) { 1094 case 0 ... 0x0f: 1095 /* offset index into scratch registers since 1096 * TI64 mode can use registers C to R */ 1097 addr_high = s->scratch[2 + selector]; 1098 break; 1099 case 0x10: 1100 addr_high = s->mmrs; 1101 break; 1102 case 0x11: 1103 addr_high = s->mmws; 1104 break; 1105 case 0x12: 1106 addr_high = s->sfs; 1107 break; 1108 case 0x13: 1109 addr_high = s->drs; 1110 break; 1111 case 0x14: 1112 addr_high = s->sbms; 1113 break; 1114 case 0x15: 1115 addr_high = s->dbms; 1116 break; 1117 default: 1118 BADF("Illegal selector specified (0x%x > 0x15)" 1119 " for 64-bit DMA block move", selector); 1120 break; 1121 } 1122 } 1123 } else if (lsi_dma_64bit(s)) { 1124 /* fetch a 3rd dword if 64-bit direct move is enabled and 1125 only if we're not doing table indirect or indirect addressing */ 1126 s->dbms = read_dword(s, s->dsp); 1127 s->dsp += 4; 1128 s->ia = s->dsp - 12; 1129 } 1130 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) { 1131 DPRINTF("Wrong phase got %d expected %d\n", 1132 s->sstat1 & PHASE_MASK, (insn >> 24) & 7); 1133 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0); 1134 break; 1135 } 1136 s->dnad = addr; 1137 s->dnad64 = addr_high; 1138 switch (s->sstat1 & 0x7) { 1139 case PHASE_DO: 1140 s->waiting = 2; 1141 lsi_do_dma(s, 1); 1142 if (s->waiting) 1143 s->waiting = 3; 1144 break; 1145 case PHASE_DI: 1146 s->waiting = 2; 1147 lsi_do_dma(s, 0); 1148 if (s->waiting) 1149 s->waiting = 3; 1150 break; 1151 case PHASE_CMD: 1152 lsi_do_command(s); 1153 break; 1154 case PHASE_ST: 1155 lsi_do_status(s); 1156 break; 1157 case PHASE_MO: 1158 lsi_do_msgout(s); 1159 break; 1160 case PHASE_MI: 1161 lsi_do_msgin(s); 1162 break; 1163 default: 1164 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK); 1165 exit(1); 1166 } 1167 s->dfifo = s->dbc & 0xff; 1168 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3); 1169 s->sbc = s->dbc; 1170 s->rbc -= s->dbc; 1171 s->ua = addr + s->dbc; 1172 break; 1173 1174 case 1: /* IO or Read/Write instruction. */ 1175 opcode = (insn >> 27) & 7; 1176 if (opcode < 5) { 1177 uint32_t id; 1178 1179 if (insn & (1 << 25)) { 1180 id = read_dword(s, s->dsa + sextract32(insn, 0, 24)); 1181 } else { 1182 id = insn; 1183 } 1184 id = (id >> 16) & 0xf; 1185 if (insn & (1 << 26)) { 1186 addr = s->dsp + sextract32(addr, 0, 24); 1187 } 1188 s->dnad = addr; 1189 switch (opcode) { 1190 case 0: /* Select */ 1191 s->sdid = id; 1192 if (s->scntl1 & LSI_SCNTL1_CON) { 1193 DPRINTF("Already reselected, jumping to alternative address\n"); 1194 s->dsp = s->dnad; 1195 break; 1196 } 1197 s->sstat0 |= LSI_SSTAT0_WOA; 1198 s->scntl1 &= ~LSI_SCNTL1_IARB; 1199 if (!scsi_device_find(&s->bus, 0, id, 0)) { 1200 lsi_bad_selection(s, id); 1201 break; 1202 } 1203 DPRINTF("Selected target %d%s\n", 1204 id, insn & (1 << 3) ? " ATN" : ""); 1205 /* ??? Linux drivers compain when this is set. Maybe 1206 it only applies in low-level mode (unimplemented). 1207 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */ 1208 s->select_tag = id << 8; 1209 s->scntl1 |= LSI_SCNTL1_CON; 1210 if (insn & (1 << 3)) { 1211 s->socl |= LSI_SOCL_ATN; 1212 } 1213 lsi_set_phase(s, PHASE_MO); 1214 break; 1215 case 1: /* Disconnect */ 1216 DPRINTF("Wait Disconnect\n"); 1217 s->scntl1 &= ~LSI_SCNTL1_CON; 1218 break; 1219 case 2: /* Wait Reselect */ 1220 if (!lsi_irq_on_rsl(s)) { 1221 lsi_wait_reselect(s); 1222 } 1223 break; 1224 case 3: /* Set */ 1225 DPRINTF("Set%s%s%s%s\n", 1226 insn & (1 << 3) ? " ATN" : "", 1227 insn & (1 << 6) ? " ACK" : "", 1228 insn & (1 << 9) ? " TM" : "", 1229 insn & (1 << 10) ? " CC" : ""); 1230 if (insn & (1 << 3)) { 1231 s->socl |= LSI_SOCL_ATN; 1232 lsi_set_phase(s, PHASE_MO); 1233 } 1234 if (insn & (1 << 9)) { 1235 BADF("Target mode not implemented\n"); 1236 exit(1); 1237 } 1238 if (insn & (1 << 10)) 1239 s->carry = 1; 1240 break; 1241 case 4: /* Clear */ 1242 DPRINTF("Clear%s%s%s%s\n", 1243 insn & (1 << 3) ? " ATN" : "", 1244 insn & (1 << 6) ? " ACK" : "", 1245 insn & (1 << 9) ? " TM" : "", 1246 insn & (1 << 10) ? " CC" : ""); 1247 if (insn & (1 << 3)) { 1248 s->socl &= ~LSI_SOCL_ATN; 1249 } 1250 if (insn & (1 << 10)) 1251 s->carry = 0; 1252 break; 1253 } 1254 } else { 1255 uint8_t op0; 1256 uint8_t op1; 1257 uint8_t data8; 1258 int reg; 1259 int operator; 1260 #ifdef DEBUG_LSI 1261 static const char *opcode_names[3] = 1262 {"Write", "Read", "Read-Modify-Write"}; 1263 static const char *operator_names[8] = 1264 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"}; 1265 #endif 1266 1267 reg = ((insn >> 16) & 0x7f) | (insn & 0x80); 1268 data8 = (insn >> 8) & 0xff; 1269 opcode = (insn >> 27) & 7; 1270 operator = (insn >> 24) & 7; 1271 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n", 1272 opcode_names[opcode - 5], reg, 1273 operator_names[operator], data8, s->sfbr, 1274 (insn & (1 << 23)) ? " SFBR" : ""); 1275 op0 = op1 = 0; 1276 switch (opcode) { 1277 case 5: /* From SFBR */ 1278 op0 = s->sfbr; 1279 op1 = data8; 1280 break; 1281 case 6: /* To SFBR */ 1282 if (operator) 1283 op0 = lsi_reg_readb(s, reg); 1284 op1 = data8; 1285 break; 1286 case 7: /* Read-modify-write */ 1287 if (operator) 1288 op0 = lsi_reg_readb(s, reg); 1289 if (insn & (1 << 23)) { 1290 op1 = s->sfbr; 1291 } else { 1292 op1 = data8; 1293 } 1294 break; 1295 } 1296 1297 switch (operator) { 1298 case 0: /* move */ 1299 op0 = op1; 1300 break; 1301 case 1: /* Shift left */ 1302 op1 = op0 >> 7; 1303 op0 = (op0 << 1) | s->carry; 1304 s->carry = op1; 1305 break; 1306 case 2: /* OR */ 1307 op0 |= op1; 1308 break; 1309 case 3: /* XOR */ 1310 op0 ^= op1; 1311 break; 1312 case 4: /* AND */ 1313 op0 &= op1; 1314 break; 1315 case 5: /* SHR */ 1316 op1 = op0 & 1; 1317 op0 = (op0 >> 1) | (s->carry << 7); 1318 s->carry = op1; 1319 break; 1320 case 6: /* ADD */ 1321 op0 += op1; 1322 s->carry = op0 < op1; 1323 break; 1324 case 7: /* ADC */ 1325 op0 += op1 + s->carry; 1326 if (s->carry) 1327 s->carry = op0 <= op1; 1328 else 1329 s->carry = op0 < op1; 1330 break; 1331 } 1332 1333 switch (opcode) { 1334 case 5: /* From SFBR */ 1335 case 7: /* Read-modify-write */ 1336 lsi_reg_writeb(s, reg, op0); 1337 break; 1338 case 6: /* To SFBR */ 1339 s->sfbr = op0; 1340 break; 1341 } 1342 } 1343 break; 1344 1345 case 2: /* Transfer Control. */ 1346 { 1347 int cond; 1348 int jmp; 1349 1350 if ((insn & 0x002e0000) == 0) { 1351 DPRINTF("NOP\n"); 1352 break; 1353 } 1354 if (s->sist1 & LSI_SIST1_STO) { 1355 DPRINTF("Delayed select timeout\n"); 1356 lsi_stop_script(s); 1357 break; 1358 } 1359 cond = jmp = (insn & (1 << 19)) != 0; 1360 if (cond == jmp && (insn & (1 << 21))) { 1361 DPRINTF("Compare carry %d\n", s->carry == jmp); 1362 cond = s->carry != 0; 1363 } 1364 if (cond == jmp && (insn & (1 << 17))) { 1365 DPRINTF("Compare phase %d %c= %d\n", 1366 (s->sstat1 & PHASE_MASK), 1367 jmp ? '=' : '!', 1368 ((insn >> 24) & 7)); 1369 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7); 1370 } 1371 if (cond == jmp && (insn & (1 << 18))) { 1372 uint8_t mask; 1373 1374 mask = (~insn >> 8) & 0xff; 1375 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n", 1376 s->sfbr, mask, jmp ? '=' : '!', insn & mask); 1377 cond = (s->sfbr & mask) == (insn & mask); 1378 } 1379 if (cond == jmp) { 1380 if (insn & (1 << 23)) { 1381 /* Relative address. */ 1382 addr = s->dsp + sextract32(addr, 0, 24); 1383 } 1384 switch ((insn >> 27) & 7) { 1385 case 0: /* Jump */ 1386 DPRINTF("Jump to 0x%08x\n", addr); 1387 s->dsp = addr; 1388 break; 1389 case 1: /* Call */ 1390 DPRINTF("Call 0x%08x\n", addr); 1391 s->temp = s->dsp; 1392 s->dsp = addr; 1393 break; 1394 case 2: /* Return */ 1395 DPRINTF("Return to 0x%08x\n", s->temp); 1396 s->dsp = s->temp; 1397 break; 1398 case 3: /* Interrupt */ 1399 DPRINTF("Interrupt 0x%08x\n", s->dsps); 1400 if ((insn & (1 << 20)) != 0) { 1401 s->istat0 |= LSI_ISTAT0_INTF; 1402 lsi_update_irq(s); 1403 } else { 1404 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR); 1405 } 1406 break; 1407 default: 1408 DPRINTF("Illegal transfer control\n"); 1409 lsi_script_dma_interrupt(s, LSI_DSTAT_IID); 1410 break; 1411 } 1412 } else { 1413 DPRINTF("Control condition failed\n"); 1414 } 1415 } 1416 break; 1417 1418 case 3: 1419 if ((insn & (1 << 29)) == 0) { 1420 /* Memory move. */ 1421 uint32_t dest; 1422 /* ??? The docs imply the destination address is loaded into 1423 the TEMP register. However the Linux drivers rely on 1424 the value being presrved. */ 1425 dest = read_dword(s, s->dsp); 1426 s->dsp += 4; 1427 lsi_memcpy(s, dest, addr, insn & 0xffffff); 1428 } else { 1429 uint8_t data[7]; 1430 int reg; 1431 int n; 1432 int i; 1433 1434 if (insn & (1 << 28)) { 1435 addr = s->dsa + sextract32(addr, 0, 24); 1436 } 1437 n = (insn & 7); 1438 reg = (insn >> 16) & 0xff; 1439 if (insn & (1 << 24)) { 1440 pci_dma_read(pci_dev, addr, data, n); 1441 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n, 1442 addr, *(int *)data); 1443 for (i = 0; i < n; i++) { 1444 lsi_reg_writeb(s, reg + i, data[i]); 1445 } 1446 } else { 1447 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr); 1448 for (i = 0; i < n; i++) { 1449 data[i] = lsi_reg_readb(s, reg + i); 1450 } 1451 pci_dma_write(pci_dev, addr, data, n); 1452 } 1453 } 1454 } 1455 if (insn_processed > 10000 && !s->waiting) { 1456 /* Some windows drivers make the device spin waiting for a memory 1457 location to change. If we have been executed a lot of code then 1458 assume this is the case and force an unexpected device disconnect. 1459 This is apparently sufficient to beat the drivers into submission. 1460 */ 1461 if (!(s->sien0 & LSI_SIST0_UDC)) 1462 fprintf(stderr, "inf. loop with UDC masked\n"); 1463 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0); 1464 lsi_disconnect(s); 1465 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) { 1466 if (s->dcntl & LSI_DCNTL_SSM) { 1467 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI); 1468 } else { 1469 goto again; 1470 } 1471 } 1472 DPRINTF("SCRIPTS execution stopped\n"); 1473 } 1474 1475 static uint8_t lsi_reg_readb(LSIState *s, int offset) 1476 { 1477 uint8_t tmp; 1478 #define CASE_GET_REG24(name, addr) \ 1479 case addr: return s->name & 0xff; \ 1480 case addr + 1: return (s->name >> 8) & 0xff; \ 1481 case addr + 2: return (s->name >> 16) & 0xff; 1482 1483 #define CASE_GET_REG32(name, addr) \ 1484 case addr: return s->name & 0xff; \ 1485 case addr + 1: return (s->name >> 8) & 0xff; \ 1486 case addr + 2: return (s->name >> 16) & 0xff; \ 1487 case addr + 3: return (s->name >> 24) & 0xff; 1488 1489 #ifdef DEBUG_LSI_REG 1490 DPRINTF("Read reg %x\n", offset); 1491 #endif 1492 switch (offset) { 1493 case 0x00: /* SCNTL0 */ 1494 return s->scntl0; 1495 case 0x01: /* SCNTL1 */ 1496 return s->scntl1; 1497 case 0x02: /* SCNTL2 */ 1498 return s->scntl2; 1499 case 0x03: /* SCNTL3 */ 1500 return s->scntl3; 1501 case 0x04: /* SCID */ 1502 return s->scid; 1503 case 0x05: /* SXFER */ 1504 return s->sxfer; 1505 case 0x06: /* SDID */ 1506 return s->sdid; 1507 case 0x07: /* GPREG0 */ 1508 return 0x7f; 1509 case 0x08: /* Revision ID */ 1510 return 0x00; 1511 case 0xa: /* SSID */ 1512 return s->ssid; 1513 case 0xb: /* SBCL */ 1514 /* ??? This is not correct. However it's (hopefully) only 1515 used for diagnostics, so should be ok. */ 1516 return 0; 1517 case 0xc: /* DSTAT */ 1518 tmp = s->dstat | 0x80; 1519 if ((s->istat0 & LSI_ISTAT0_INTF) == 0) 1520 s->dstat = 0; 1521 lsi_update_irq(s); 1522 return tmp; 1523 case 0x0d: /* SSTAT0 */ 1524 return s->sstat0; 1525 case 0x0e: /* SSTAT1 */ 1526 return s->sstat1; 1527 case 0x0f: /* SSTAT2 */ 1528 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2; 1529 CASE_GET_REG32(dsa, 0x10) 1530 case 0x14: /* ISTAT0 */ 1531 return s->istat0; 1532 case 0x15: /* ISTAT1 */ 1533 return s->istat1; 1534 case 0x16: /* MBOX0 */ 1535 return s->mbox0; 1536 case 0x17: /* MBOX1 */ 1537 return s->mbox1; 1538 case 0x18: /* CTEST0 */ 1539 return 0xff; 1540 case 0x19: /* CTEST1 */ 1541 return 0; 1542 case 0x1a: /* CTEST2 */ 1543 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM; 1544 if (s->istat0 & LSI_ISTAT0_SIGP) { 1545 s->istat0 &= ~LSI_ISTAT0_SIGP; 1546 tmp |= LSI_CTEST2_SIGP; 1547 } 1548 return tmp; 1549 case 0x1b: /* CTEST3 */ 1550 return s->ctest3; 1551 CASE_GET_REG32(temp, 0x1c) 1552 case 0x20: /* DFIFO */ 1553 return 0; 1554 case 0x21: /* CTEST4 */ 1555 return s->ctest4; 1556 case 0x22: /* CTEST5 */ 1557 return s->ctest5; 1558 case 0x23: /* CTEST6 */ 1559 return 0; 1560 CASE_GET_REG24(dbc, 0x24) 1561 case 0x27: /* DCMD */ 1562 return s->dcmd; 1563 CASE_GET_REG32(dnad, 0x28) 1564 CASE_GET_REG32(dsp, 0x2c) 1565 CASE_GET_REG32(dsps, 0x30) 1566 CASE_GET_REG32(scratch[0], 0x34) 1567 case 0x38: /* DMODE */ 1568 return s->dmode; 1569 case 0x39: /* DIEN */ 1570 return s->dien; 1571 case 0x3a: /* SBR */ 1572 return s->sbr; 1573 case 0x3b: /* DCNTL */ 1574 return s->dcntl; 1575 case 0x40: /* SIEN0 */ 1576 return s->sien0; 1577 case 0x41: /* SIEN1 */ 1578 return s->sien1; 1579 case 0x42: /* SIST0 */ 1580 tmp = s->sist0; 1581 s->sist0 = 0; 1582 lsi_update_irq(s); 1583 return tmp; 1584 case 0x43: /* SIST1 */ 1585 tmp = s->sist1; 1586 s->sist1 = 0; 1587 lsi_update_irq(s); 1588 return tmp; 1589 case 0x46: /* MACNTL */ 1590 return 0x0f; 1591 case 0x47: /* GPCNTL0 */ 1592 return 0x0f; 1593 case 0x48: /* STIME0 */ 1594 return s->stime0; 1595 case 0x4a: /* RESPID0 */ 1596 return s->respid0; 1597 case 0x4b: /* RESPID1 */ 1598 return s->respid1; 1599 case 0x4d: /* STEST1 */ 1600 return s->stest1; 1601 case 0x4e: /* STEST2 */ 1602 return s->stest2; 1603 case 0x4f: /* STEST3 */ 1604 return s->stest3; 1605 case 0x50: /* SIDL */ 1606 /* This is needed by the linux drivers. We currently only update it 1607 during the MSG IN phase. */ 1608 return s->sidl; 1609 case 0x52: /* STEST4 */ 1610 return 0xe0; 1611 case 0x56: /* CCNTL0 */ 1612 return s->ccntl0; 1613 case 0x57: /* CCNTL1 */ 1614 return s->ccntl1; 1615 case 0x58: /* SBDL */ 1616 /* Some drivers peek at the data bus during the MSG IN phase. */ 1617 if ((s->sstat1 & PHASE_MASK) == PHASE_MI) 1618 return s->msg[0]; 1619 return 0; 1620 case 0x59: /* SBDL high */ 1621 return 0; 1622 CASE_GET_REG32(mmrs, 0xa0) 1623 CASE_GET_REG32(mmws, 0xa4) 1624 CASE_GET_REG32(sfs, 0xa8) 1625 CASE_GET_REG32(drs, 0xac) 1626 CASE_GET_REG32(sbms, 0xb0) 1627 CASE_GET_REG32(dbms, 0xb4) 1628 CASE_GET_REG32(dnad64, 0xb8) 1629 CASE_GET_REG32(pmjad1, 0xc0) 1630 CASE_GET_REG32(pmjad2, 0xc4) 1631 CASE_GET_REG32(rbc, 0xc8) 1632 CASE_GET_REG32(ua, 0xcc) 1633 CASE_GET_REG32(ia, 0xd4) 1634 CASE_GET_REG32(sbc, 0xd8) 1635 CASE_GET_REG32(csbc, 0xdc) 1636 } 1637 if (offset >= 0x5c && offset < 0xa0) { 1638 int n; 1639 int shift; 1640 n = (offset - 0x58) >> 2; 1641 shift = (offset & 3) * 8; 1642 return (s->scratch[n] >> shift) & 0xff; 1643 } 1644 BADF("readb 0x%x\n", offset); 1645 exit(1); 1646 #undef CASE_GET_REG24 1647 #undef CASE_GET_REG32 1648 } 1649 1650 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val) 1651 { 1652 #define CASE_SET_REG24(name, addr) \ 1653 case addr : s->name &= 0xffffff00; s->name |= val; break; \ 1654 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \ 1655 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; 1656 1657 #define CASE_SET_REG32(name, addr) \ 1658 case addr : s->name &= 0xffffff00; s->name |= val; break; \ 1659 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \ 1660 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \ 1661 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break; 1662 1663 #ifdef DEBUG_LSI_REG 1664 DPRINTF("Write reg %x = %02x\n", offset, val); 1665 #endif 1666 switch (offset) { 1667 case 0x00: /* SCNTL0 */ 1668 s->scntl0 = val; 1669 if (val & LSI_SCNTL0_START) { 1670 BADF("Start sequence not implemented\n"); 1671 } 1672 break; 1673 case 0x01: /* SCNTL1 */ 1674 s->scntl1 = val & ~LSI_SCNTL1_SST; 1675 if (val & LSI_SCNTL1_IARB) { 1676 BADF("Immediate Arbritration not implemented\n"); 1677 } 1678 if (val & LSI_SCNTL1_RST) { 1679 if (!(s->sstat0 & LSI_SSTAT0_RST)) { 1680 qbus_reset_all(&s->bus.qbus); 1681 s->sstat0 |= LSI_SSTAT0_RST; 1682 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0); 1683 } 1684 } else { 1685 s->sstat0 &= ~LSI_SSTAT0_RST; 1686 } 1687 break; 1688 case 0x02: /* SCNTL2 */ 1689 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS); 1690 s->scntl2 = val; 1691 break; 1692 case 0x03: /* SCNTL3 */ 1693 s->scntl3 = val; 1694 break; 1695 case 0x04: /* SCID */ 1696 s->scid = val; 1697 break; 1698 case 0x05: /* SXFER */ 1699 s->sxfer = val; 1700 break; 1701 case 0x06: /* SDID */ 1702 if ((val & 0xf) != (s->ssid & 0xf)) 1703 BADF("Destination ID does not match SSID\n"); 1704 s->sdid = val & 0xf; 1705 break; 1706 case 0x07: /* GPREG0 */ 1707 break; 1708 case 0x08: /* SFBR */ 1709 /* The CPU is not allowed to write to this register. However the 1710 SCRIPTS register move instructions are. */ 1711 s->sfbr = val; 1712 break; 1713 case 0x0a: case 0x0b: 1714 /* Openserver writes to these readonly registers on startup */ 1715 return; 1716 case 0x0c: case 0x0d: case 0x0e: case 0x0f: 1717 /* Linux writes to these readonly registers on startup. */ 1718 return; 1719 CASE_SET_REG32(dsa, 0x10) 1720 case 0x14: /* ISTAT0 */ 1721 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0); 1722 if (val & LSI_ISTAT0_ABRT) { 1723 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT); 1724 } 1725 if (val & LSI_ISTAT0_INTF) { 1726 s->istat0 &= ~LSI_ISTAT0_INTF; 1727 lsi_update_irq(s); 1728 } 1729 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) { 1730 DPRINTF("Woken by SIGP\n"); 1731 s->waiting = 0; 1732 s->dsp = s->dnad; 1733 lsi_execute_script(s); 1734 } 1735 if (val & LSI_ISTAT0_SRST) { 1736 qdev_reset_all(DEVICE(s)); 1737 } 1738 break; 1739 case 0x16: /* MBOX0 */ 1740 s->mbox0 = val; 1741 break; 1742 case 0x17: /* MBOX1 */ 1743 s->mbox1 = val; 1744 break; 1745 case 0x1a: /* CTEST2 */ 1746 s->ctest2 = val & LSI_CTEST2_PCICIE; 1747 break; 1748 case 0x1b: /* CTEST3 */ 1749 s->ctest3 = val & 0x0f; 1750 break; 1751 CASE_SET_REG32(temp, 0x1c) 1752 case 0x21: /* CTEST4 */ 1753 if (val & 7) { 1754 BADF("Unimplemented CTEST4-FBL 0x%x\n", val); 1755 } 1756 s->ctest4 = val; 1757 break; 1758 case 0x22: /* CTEST5 */ 1759 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) { 1760 BADF("CTEST5 DMA increment not implemented\n"); 1761 } 1762 s->ctest5 = val; 1763 break; 1764 CASE_SET_REG24(dbc, 0x24) 1765 CASE_SET_REG32(dnad, 0x28) 1766 case 0x2c: /* DSP[0:7] */ 1767 s->dsp &= 0xffffff00; 1768 s->dsp |= val; 1769 break; 1770 case 0x2d: /* DSP[8:15] */ 1771 s->dsp &= 0xffff00ff; 1772 s->dsp |= val << 8; 1773 break; 1774 case 0x2e: /* DSP[16:23] */ 1775 s->dsp &= 0xff00ffff; 1776 s->dsp |= val << 16; 1777 break; 1778 case 0x2f: /* DSP[24:31] */ 1779 s->dsp &= 0x00ffffff; 1780 s->dsp |= val << 24; 1781 if ((s->dmode & LSI_DMODE_MAN) == 0 1782 && (s->istat1 & LSI_ISTAT1_SRUN) == 0) 1783 lsi_execute_script(s); 1784 break; 1785 CASE_SET_REG32(dsps, 0x30) 1786 CASE_SET_REG32(scratch[0], 0x34) 1787 case 0x38: /* DMODE */ 1788 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) { 1789 BADF("IO mappings not implemented\n"); 1790 } 1791 s->dmode = val; 1792 break; 1793 case 0x39: /* DIEN */ 1794 s->dien = val; 1795 lsi_update_irq(s); 1796 break; 1797 case 0x3a: /* SBR */ 1798 s->sbr = val; 1799 break; 1800 case 0x3b: /* DCNTL */ 1801 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD); 1802 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0) 1803 lsi_execute_script(s); 1804 break; 1805 case 0x40: /* SIEN0 */ 1806 s->sien0 = val; 1807 lsi_update_irq(s); 1808 break; 1809 case 0x41: /* SIEN1 */ 1810 s->sien1 = val; 1811 lsi_update_irq(s); 1812 break; 1813 case 0x47: /* GPCNTL0 */ 1814 break; 1815 case 0x48: /* STIME0 */ 1816 s->stime0 = val; 1817 break; 1818 case 0x49: /* STIME1 */ 1819 if (val & 0xf) { 1820 DPRINTF("General purpose timer not implemented\n"); 1821 /* ??? Raising the interrupt immediately seems to be sufficient 1822 to keep the FreeBSD driver happy. */ 1823 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN); 1824 } 1825 break; 1826 case 0x4a: /* RESPID0 */ 1827 s->respid0 = val; 1828 break; 1829 case 0x4b: /* RESPID1 */ 1830 s->respid1 = val; 1831 break; 1832 case 0x4d: /* STEST1 */ 1833 s->stest1 = val; 1834 break; 1835 case 0x4e: /* STEST2 */ 1836 if (val & 1) { 1837 BADF("Low level mode not implemented\n"); 1838 } 1839 s->stest2 = val; 1840 break; 1841 case 0x4f: /* STEST3 */ 1842 if (val & 0x41) { 1843 BADF("SCSI FIFO test mode not implemented\n"); 1844 } 1845 s->stest3 = val; 1846 break; 1847 case 0x56: /* CCNTL0 */ 1848 s->ccntl0 = val; 1849 break; 1850 case 0x57: /* CCNTL1 */ 1851 s->ccntl1 = val; 1852 break; 1853 CASE_SET_REG32(mmrs, 0xa0) 1854 CASE_SET_REG32(mmws, 0xa4) 1855 CASE_SET_REG32(sfs, 0xa8) 1856 CASE_SET_REG32(drs, 0xac) 1857 CASE_SET_REG32(sbms, 0xb0) 1858 CASE_SET_REG32(dbms, 0xb4) 1859 CASE_SET_REG32(dnad64, 0xb8) 1860 CASE_SET_REG32(pmjad1, 0xc0) 1861 CASE_SET_REG32(pmjad2, 0xc4) 1862 CASE_SET_REG32(rbc, 0xc8) 1863 CASE_SET_REG32(ua, 0xcc) 1864 CASE_SET_REG32(ia, 0xd4) 1865 CASE_SET_REG32(sbc, 0xd8) 1866 CASE_SET_REG32(csbc, 0xdc) 1867 default: 1868 if (offset >= 0x5c && offset < 0xa0) { 1869 int n; 1870 int shift; 1871 n = (offset - 0x58) >> 2; 1872 shift = (offset & 3) * 8; 1873 s->scratch[n] = deposit32(s->scratch[n], shift, 8, val); 1874 } else { 1875 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val); 1876 } 1877 } 1878 #undef CASE_SET_REG24 1879 #undef CASE_SET_REG32 1880 } 1881 1882 static void lsi_mmio_write(void *opaque, hwaddr addr, 1883 uint64_t val, unsigned size) 1884 { 1885 LSIState *s = opaque; 1886 1887 lsi_reg_writeb(s, addr & 0xff, val); 1888 } 1889 1890 static uint64_t lsi_mmio_read(void *opaque, hwaddr addr, 1891 unsigned size) 1892 { 1893 LSIState *s = opaque; 1894 1895 return lsi_reg_readb(s, addr & 0xff); 1896 } 1897 1898 static const MemoryRegionOps lsi_mmio_ops = { 1899 .read = lsi_mmio_read, 1900 .write = lsi_mmio_write, 1901 .endianness = DEVICE_NATIVE_ENDIAN, 1902 .impl = { 1903 .min_access_size = 1, 1904 .max_access_size = 1, 1905 }, 1906 }; 1907 1908 static void lsi_ram_write(void *opaque, hwaddr addr, 1909 uint64_t val, unsigned size) 1910 { 1911 LSIState *s = opaque; 1912 uint32_t newval; 1913 uint32_t mask; 1914 int shift; 1915 1916 newval = s->script_ram[addr >> 2]; 1917 shift = (addr & 3) * 8; 1918 mask = ((uint64_t)1 << (size * 8)) - 1; 1919 newval &= ~(mask << shift); 1920 newval |= val << shift; 1921 s->script_ram[addr >> 2] = newval; 1922 } 1923 1924 static uint64_t lsi_ram_read(void *opaque, hwaddr addr, 1925 unsigned size) 1926 { 1927 LSIState *s = opaque; 1928 uint32_t val; 1929 uint32_t mask; 1930 1931 val = s->script_ram[addr >> 2]; 1932 mask = ((uint64_t)1 << (size * 8)) - 1; 1933 val >>= (addr & 3) * 8; 1934 return val & mask; 1935 } 1936 1937 static const MemoryRegionOps lsi_ram_ops = { 1938 .read = lsi_ram_read, 1939 .write = lsi_ram_write, 1940 .endianness = DEVICE_NATIVE_ENDIAN, 1941 }; 1942 1943 static uint64_t lsi_io_read(void *opaque, hwaddr addr, 1944 unsigned size) 1945 { 1946 LSIState *s = opaque; 1947 return lsi_reg_readb(s, addr & 0xff); 1948 } 1949 1950 static void lsi_io_write(void *opaque, hwaddr addr, 1951 uint64_t val, unsigned size) 1952 { 1953 LSIState *s = opaque; 1954 lsi_reg_writeb(s, addr & 0xff, val); 1955 } 1956 1957 static const MemoryRegionOps lsi_io_ops = { 1958 .read = lsi_io_read, 1959 .write = lsi_io_write, 1960 .endianness = DEVICE_NATIVE_ENDIAN, 1961 .impl = { 1962 .min_access_size = 1, 1963 .max_access_size = 1, 1964 }, 1965 }; 1966 1967 static void lsi_scsi_reset(DeviceState *dev) 1968 { 1969 LSIState *s = LSI53C895A(dev); 1970 1971 lsi_soft_reset(s); 1972 } 1973 1974 static void lsi_pre_save(void *opaque) 1975 { 1976 LSIState *s = opaque; 1977 1978 if (s->current) { 1979 assert(s->current->dma_buf == NULL); 1980 assert(s->current->dma_len == 0); 1981 } 1982 assert(QTAILQ_EMPTY(&s->queue)); 1983 } 1984 1985 static const VMStateDescription vmstate_lsi_scsi = { 1986 .name = "lsiscsi", 1987 .version_id = 0, 1988 .minimum_version_id = 0, 1989 .minimum_version_id_old = 0, 1990 .pre_save = lsi_pre_save, 1991 .fields = (VMStateField []) { 1992 VMSTATE_PCI_DEVICE(parent_obj, LSIState), 1993 1994 VMSTATE_INT32(carry, LSIState), 1995 VMSTATE_INT32(status, LSIState), 1996 VMSTATE_INT32(msg_action, LSIState), 1997 VMSTATE_INT32(msg_len, LSIState), 1998 VMSTATE_BUFFER(msg, LSIState), 1999 VMSTATE_INT32(waiting, LSIState), 2000 2001 VMSTATE_UINT32(dsa, LSIState), 2002 VMSTATE_UINT32(temp, LSIState), 2003 VMSTATE_UINT32(dnad, LSIState), 2004 VMSTATE_UINT32(dbc, LSIState), 2005 VMSTATE_UINT8(istat0, LSIState), 2006 VMSTATE_UINT8(istat1, LSIState), 2007 VMSTATE_UINT8(dcmd, LSIState), 2008 VMSTATE_UINT8(dstat, LSIState), 2009 VMSTATE_UINT8(dien, LSIState), 2010 VMSTATE_UINT8(sist0, LSIState), 2011 VMSTATE_UINT8(sist1, LSIState), 2012 VMSTATE_UINT8(sien0, LSIState), 2013 VMSTATE_UINT8(sien1, LSIState), 2014 VMSTATE_UINT8(mbox0, LSIState), 2015 VMSTATE_UINT8(mbox1, LSIState), 2016 VMSTATE_UINT8(dfifo, LSIState), 2017 VMSTATE_UINT8(ctest2, LSIState), 2018 VMSTATE_UINT8(ctest3, LSIState), 2019 VMSTATE_UINT8(ctest4, LSIState), 2020 VMSTATE_UINT8(ctest5, LSIState), 2021 VMSTATE_UINT8(ccntl0, LSIState), 2022 VMSTATE_UINT8(ccntl1, LSIState), 2023 VMSTATE_UINT32(dsp, LSIState), 2024 VMSTATE_UINT32(dsps, LSIState), 2025 VMSTATE_UINT8(dmode, LSIState), 2026 VMSTATE_UINT8(dcntl, LSIState), 2027 VMSTATE_UINT8(scntl0, LSIState), 2028 VMSTATE_UINT8(scntl1, LSIState), 2029 VMSTATE_UINT8(scntl2, LSIState), 2030 VMSTATE_UINT8(scntl3, LSIState), 2031 VMSTATE_UINT8(sstat0, LSIState), 2032 VMSTATE_UINT8(sstat1, LSIState), 2033 VMSTATE_UINT8(scid, LSIState), 2034 VMSTATE_UINT8(sxfer, LSIState), 2035 VMSTATE_UINT8(socl, LSIState), 2036 VMSTATE_UINT8(sdid, LSIState), 2037 VMSTATE_UINT8(ssid, LSIState), 2038 VMSTATE_UINT8(sfbr, LSIState), 2039 VMSTATE_UINT8(stest1, LSIState), 2040 VMSTATE_UINT8(stest2, LSIState), 2041 VMSTATE_UINT8(stest3, LSIState), 2042 VMSTATE_UINT8(sidl, LSIState), 2043 VMSTATE_UINT8(stime0, LSIState), 2044 VMSTATE_UINT8(respid0, LSIState), 2045 VMSTATE_UINT8(respid1, LSIState), 2046 VMSTATE_UINT32(mmrs, LSIState), 2047 VMSTATE_UINT32(mmws, LSIState), 2048 VMSTATE_UINT32(sfs, LSIState), 2049 VMSTATE_UINT32(drs, LSIState), 2050 VMSTATE_UINT32(sbms, LSIState), 2051 VMSTATE_UINT32(dbms, LSIState), 2052 VMSTATE_UINT32(dnad64, LSIState), 2053 VMSTATE_UINT32(pmjad1, LSIState), 2054 VMSTATE_UINT32(pmjad2, LSIState), 2055 VMSTATE_UINT32(rbc, LSIState), 2056 VMSTATE_UINT32(ua, LSIState), 2057 VMSTATE_UINT32(ia, LSIState), 2058 VMSTATE_UINT32(sbc, LSIState), 2059 VMSTATE_UINT32(csbc, LSIState), 2060 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)), 2061 VMSTATE_UINT8(sbr, LSIState), 2062 2063 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)), 2064 VMSTATE_END_OF_LIST() 2065 } 2066 }; 2067 2068 static void lsi_scsi_uninit(PCIDevice *d) 2069 { 2070 LSIState *s = LSI53C895A(d); 2071 2072 memory_region_destroy(&s->mmio_io); 2073 memory_region_destroy(&s->ram_io); 2074 memory_region_destroy(&s->io_io); 2075 } 2076 2077 static const struct SCSIBusInfo lsi_scsi_info = { 2078 .tcq = true, 2079 .max_target = LSI_MAX_DEVS, 2080 .max_lun = 0, /* LUN support is buggy */ 2081 2082 .transfer_data = lsi_transfer_data, 2083 .complete = lsi_command_complete, 2084 .cancel = lsi_request_cancelled 2085 }; 2086 2087 static int lsi_scsi_init(PCIDevice *dev) 2088 { 2089 LSIState *s = LSI53C895A(dev); 2090 DeviceState *d = DEVICE(dev); 2091 uint8_t *pci_conf; 2092 Error *err = NULL; 2093 2094 pci_conf = dev->config; 2095 2096 /* PCI latency timer = 255 */ 2097 pci_conf[PCI_LATENCY_TIMER] = 0xff; 2098 /* Interrupt pin A */ 2099 pci_conf[PCI_INTERRUPT_PIN] = 0x01; 2100 2101 memory_region_init_io(&s->mmio_io, OBJECT(s), &lsi_mmio_ops, s, 2102 "lsi-mmio", 0x400); 2103 memory_region_init_io(&s->ram_io, OBJECT(s), &lsi_ram_ops, s, 2104 "lsi-ram", 0x2000); 2105 memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s, 2106 "lsi-io", 256); 2107 2108 pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io); 2109 pci_register_bar(dev, 1, 0, &s->mmio_io); 2110 pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io); 2111 QTAILQ_INIT(&s->queue); 2112 2113 scsi_bus_new(&s->bus, sizeof(s->bus), d, &lsi_scsi_info, NULL); 2114 if (!d->hotplugged) { 2115 scsi_bus_legacy_handle_cmdline(&s->bus, &err); 2116 if (err != NULL) { 2117 error_free(err); 2118 return -1; 2119 } 2120 } 2121 return 0; 2122 } 2123 2124 static void lsi_class_init(ObjectClass *klass, void *data) 2125 { 2126 DeviceClass *dc = DEVICE_CLASS(klass); 2127 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 2128 2129 k->init = lsi_scsi_init; 2130 k->exit = lsi_scsi_uninit; 2131 k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC; 2132 k->device_id = PCI_DEVICE_ID_LSI_53C895A; 2133 k->class_id = PCI_CLASS_STORAGE_SCSI; 2134 k->subsystem_id = 0x1000; 2135 dc->reset = lsi_scsi_reset; 2136 dc->vmsd = &vmstate_lsi_scsi; 2137 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 2138 } 2139 2140 static const TypeInfo lsi_info = { 2141 .name = TYPE_LSI53C895A, 2142 .parent = TYPE_PCI_DEVICE, 2143 .instance_size = sizeof(LSIState), 2144 .class_init = lsi_class_init, 2145 }; 2146 2147 static void lsi53c895a_register_types(void) 2148 { 2149 type_register_static(&lsi_info); 2150 } 2151 2152 type_init(lsi53c895a_register_types) 2153