1 /* 2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation 3 * 4 * Copyright (c) 2006 CodeSourcery. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the LGPL. 8 */ 9 10 /* Note: 11 * LSI53C810 emulation is incorrect, in the sense that it supports 12 * features added in later evolutions. This should not be a problem, 13 * as well-behaved operating systems will not try to use them. 14 */ 15 16 #include "qemu/osdep.h" 17 18 #include "hw/hw.h" 19 #include "hw/pci/pci.h" 20 #include "hw/scsi/scsi.h" 21 #include "sysemu/dma.h" 22 #include "qemu/log.h" 23 24 //#define DEBUG_LSI 25 //#define DEBUG_LSI_REG 26 27 #ifdef DEBUG_LSI 28 #define DPRINTF(fmt, ...) \ 29 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0) 30 #define BADF(fmt, ...) \ 31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0) 32 #else 33 #define DPRINTF(fmt, ...) do {} while(0) 34 #define BADF(fmt, ...) \ 35 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0) 36 #endif 37 38 static const char *names[] = { 39 "SCNTL0", "SCNTL1", "SCNTL2", "SCNTL3", "SCID", "SXFER", "SDID", "GPREG", 40 "SFBR", "SOCL", "SSID", "SBCL", "DSTAT", "SSTAT0", "SSTAT1", "SSTAT2", 41 "DSA0", "DSA1", "DSA2", "DSA3", "ISTAT", "0x15", "0x16", "0x17", 42 "CTEST0", "CTEST1", "CTEST2", "CTEST3", "TEMP0", "TEMP1", "TEMP2", "TEMP3", 43 "DFIFO", "CTEST4", "CTEST5", "CTEST6", "DBC0", "DBC1", "DBC2", "DCMD", 44 "DNAD0", "DNAD1", "DNAD2", "DNAD3", "DSP0", "DSP1", "DSP2", "DSP3", 45 "DSPS0", "DSPS1", "DSPS2", "DSPS3", "SCRATCHA0", "SCRATCHA1", "SCRATCHA2", "SCRATCHA3", 46 "DMODE", "DIEN", "SBR", "DCNTL", "ADDER0", "ADDER1", "ADDER2", "ADDER3", 47 "SIEN0", "SIEN1", "SIST0", "SIST1", "SLPAR", "0x45", "MACNTL", "GPCNTL", 48 "STIME0", "STIME1", "RESPID", "0x4b", "STEST0", "STEST1", "STEST2", "STEST3", 49 "SIDL", "0x51", "0x52", "0x53", "SODL", "0x55", "0x56", "0x57", 50 "SBDL", "0x59", "0x5a", "0x5b", "SCRATCHB0", "SCRATCHB1", "SCRATCHB2", "SCRATCHB3", 51 }; 52 53 #define LSI_MAX_DEVS 7 54 55 #define LSI_SCNTL0_TRG 0x01 56 #define LSI_SCNTL0_AAP 0x02 57 #define LSI_SCNTL0_EPC 0x08 58 #define LSI_SCNTL0_WATN 0x10 59 #define LSI_SCNTL0_START 0x20 60 61 #define LSI_SCNTL1_SST 0x01 62 #define LSI_SCNTL1_IARB 0x02 63 #define LSI_SCNTL1_AESP 0x04 64 #define LSI_SCNTL1_RST 0x08 65 #define LSI_SCNTL1_CON 0x10 66 #define LSI_SCNTL1_DHP 0x20 67 #define LSI_SCNTL1_ADB 0x40 68 #define LSI_SCNTL1_EXC 0x80 69 70 #define LSI_SCNTL2_WSR 0x01 71 #define LSI_SCNTL2_VUE0 0x02 72 #define LSI_SCNTL2_VUE1 0x04 73 #define LSI_SCNTL2_WSS 0x08 74 #define LSI_SCNTL2_SLPHBEN 0x10 75 #define LSI_SCNTL2_SLPMD 0x20 76 #define LSI_SCNTL2_CHM 0x40 77 #define LSI_SCNTL2_SDU 0x80 78 79 #define LSI_ISTAT0_DIP 0x01 80 #define LSI_ISTAT0_SIP 0x02 81 #define LSI_ISTAT0_INTF 0x04 82 #define LSI_ISTAT0_CON 0x08 83 #define LSI_ISTAT0_SEM 0x10 84 #define LSI_ISTAT0_SIGP 0x20 85 #define LSI_ISTAT0_SRST 0x40 86 #define LSI_ISTAT0_ABRT 0x80 87 88 #define LSI_ISTAT1_SI 0x01 89 #define LSI_ISTAT1_SRUN 0x02 90 #define LSI_ISTAT1_FLSH 0x04 91 92 #define LSI_SSTAT0_SDP0 0x01 93 #define LSI_SSTAT0_RST 0x02 94 #define LSI_SSTAT0_WOA 0x04 95 #define LSI_SSTAT0_LOA 0x08 96 #define LSI_SSTAT0_AIP 0x10 97 #define LSI_SSTAT0_OLF 0x20 98 #define LSI_SSTAT0_ORF 0x40 99 #define LSI_SSTAT0_ILF 0x80 100 101 #define LSI_SIST0_PAR 0x01 102 #define LSI_SIST0_RST 0x02 103 #define LSI_SIST0_UDC 0x04 104 #define LSI_SIST0_SGE 0x08 105 #define LSI_SIST0_RSL 0x10 106 #define LSI_SIST0_SEL 0x20 107 #define LSI_SIST0_CMP 0x40 108 #define LSI_SIST0_MA 0x80 109 110 #define LSI_SIST1_HTH 0x01 111 #define LSI_SIST1_GEN 0x02 112 #define LSI_SIST1_STO 0x04 113 #define LSI_SIST1_SBMC 0x10 114 115 #define LSI_SOCL_IO 0x01 116 #define LSI_SOCL_CD 0x02 117 #define LSI_SOCL_MSG 0x04 118 #define LSI_SOCL_ATN 0x08 119 #define LSI_SOCL_SEL 0x10 120 #define LSI_SOCL_BSY 0x20 121 #define LSI_SOCL_ACK 0x40 122 #define LSI_SOCL_REQ 0x80 123 124 #define LSI_DSTAT_IID 0x01 125 #define LSI_DSTAT_SIR 0x04 126 #define LSI_DSTAT_SSI 0x08 127 #define LSI_DSTAT_ABRT 0x10 128 #define LSI_DSTAT_BF 0x20 129 #define LSI_DSTAT_MDPE 0x40 130 #define LSI_DSTAT_DFE 0x80 131 132 #define LSI_DCNTL_COM 0x01 133 #define LSI_DCNTL_IRQD 0x02 134 #define LSI_DCNTL_STD 0x04 135 #define LSI_DCNTL_IRQM 0x08 136 #define LSI_DCNTL_SSM 0x10 137 #define LSI_DCNTL_PFEN 0x20 138 #define LSI_DCNTL_PFF 0x40 139 #define LSI_DCNTL_CLSE 0x80 140 141 #define LSI_DMODE_MAN 0x01 142 #define LSI_DMODE_BOF 0x02 143 #define LSI_DMODE_ERMP 0x04 144 #define LSI_DMODE_ERL 0x08 145 #define LSI_DMODE_DIOM 0x10 146 #define LSI_DMODE_SIOM 0x20 147 148 #define LSI_CTEST2_DACK 0x01 149 #define LSI_CTEST2_DREQ 0x02 150 #define LSI_CTEST2_TEOP 0x04 151 #define LSI_CTEST2_PCICIE 0x08 152 #define LSI_CTEST2_CM 0x10 153 #define LSI_CTEST2_CIO 0x20 154 #define LSI_CTEST2_SIGP 0x40 155 #define LSI_CTEST2_DDIR 0x80 156 157 #define LSI_CTEST5_BL2 0x04 158 #define LSI_CTEST5_DDIR 0x08 159 #define LSI_CTEST5_MASR 0x10 160 #define LSI_CTEST5_DFSN 0x20 161 #define LSI_CTEST5_BBCK 0x40 162 #define LSI_CTEST5_ADCK 0x80 163 164 #define LSI_CCNTL0_DILS 0x01 165 #define LSI_CCNTL0_DISFC 0x10 166 #define LSI_CCNTL0_ENNDJ 0x20 167 #define LSI_CCNTL0_PMJCTL 0x40 168 #define LSI_CCNTL0_ENPMJ 0x80 169 170 #define LSI_CCNTL1_EN64DBMV 0x01 171 #define LSI_CCNTL1_EN64TIBMV 0x02 172 #define LSI_CCNTL1_64TIMOD 0x04 173 #define LSI_CCNTL1_DDAC 0x08 174 #define LSI_CCNTL1_ZMOD 0x80 175 176 /* Enable Response to Reselection */ 177 #define LSI_SCID_RRE 0x60 178 179 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD) 180 181 #define PHASE_DO 0 182 #define PHASE_DI 1 183 #define PHASE_CMD 2 184 #define PHASE_ST 3 185 #define PHASE_MO 6 186 #define PHASE_MI 7 187 #define PHASE_MASK 7 188 189 /* Maximum length of MSG IN data. */ 190 #define LSI_MAX_MSGIN_LEN 8 191 192 /* Flag set if this is a tagged command. */ 193 #define LSI_TAG_VALID (1 << 16) 194 195 typedef struct lsi_request { 196 SCSIRequest *req; 197 uint32_t tag; 198 uint32_t dma_len; 199 uint8_t *dma_buf; 200 uint32_t pending; 201 int out; 202 QTAILQ_ENTRY(lsi_request) next; 203 } lsi_request; 204 205 typedef struct { 206 /*< private >*/ 207 PCIDevice parent_obj; 208 /*< public >*/ 209 210 MemoryRegion mmio_io; 211 MemoryRegion ram_io; 212 MemoryRegion io_io; 213 AddressSpace pci_io_as; 214 215 int carry; /* ??? Should this be an a visible register somewhere? */ 216 int status; 217 /* Action to take at the end of a MSG IN phase. 218 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */ 219 int msg_action; 220 int msg_len; 221 uint8_t msg[LSI_MAX_MSGIN_LEN]; 222 /* 0 if SCRIPTS are running or stopped. 223 * 1 if a Wait Reselect instruction has been issued. 224 * 2 if processing DMA from lsi_execute_script. 225 * 3 if a DMA operation is in progress. */ 226 int waiting; 227 SCSIBus bus; 228 int current_lun; 229 /* The tag is a combination of the device ID and the SCSI tag. */ 230 uint32_t select_tag; 231 int command_complete; 232 QTAILQ_HEAD(, lsi_request) queue; 233 lsi_request *current; 234 235 uint32_t dsa; 236 uint32_t temp; 237 uint32_t dnad; 238 uint32_t dbc; 239 uint8_t istat0; 240 uint8_t istat1; 241 uint8_t dcmd; 242 uint8_t dstat; 243 uint8_t dien; 244 uint8_t sist0; 245 uint8_t sist1; 246 uint8_t sien0; 247 uint8_t sien1; 248 uint8_t mbox0; 249 uint8_t mbox1; 250 uint8_t dfifo; 251 uint8_t ctest2; 252 uint8_t ctest3; 253 uint8_t ctest4; 254 uint8_t ctest5; 255 uint8_t ccntl0; 256 uint8_t ccntl1; 257 uint32_t dsp; 258 uint32_t dsps; 259 uint8_t dmode; 260 uint8_t dcntl; 261 uint8_t scntl0; 262 uint8_t scntl1; 263 uint8_t scntl2; 264 uint8_t scntl3; 265 uint8_t sstat0; 266 uint8_t sstat1; 267 uint8_t scid; 268 uint8_t sxfer; 269 uint8_t socl; 270 uint8_t sdid; 271 uint8_t ssid; 272 uint8_t sfbr; 273 uint8_t stest1; 274 uint8_t stest2; 275 uint8_t stest3; 276 uint8_t sidl; 277 uint8_t stime0; 278 uint8_t respid0; 279 uint8_t respid1; 280 uint32_t mmrs; 281 uint32_t mmws; 282 uint32_t sfs; 283 uint32_t drs; 284 uint32_t sbms; 285 uint32_t dbms; 286 uint32_t dnad64; 287 uint32_t pmjad1; 288 uint32_t pmjad2; 289 uint32_t rbc; 290 uint32_t ua; 291 uint32_t ia; 292 uint32_t sbc; 293 uint32_t csbc; 294 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */ 295 uint8_t sbr; 296 uint32_t adder; 297 298 /* Script ram is stored as 32-bit words in host byteorder. */ 299 uint32_t script_ram[2048]; 300 } LSIState; 301 302 #define TYPE_LSI53C810 "lsi53c810" 303 #define TYPE_LSI53C895A "lsi53c895a" 304 305 #define LSI53C895A(obj) \ 306 OBJECT_CHECK(LSIState, (obj), TYPE_LSI53C895A) 307 308 static inline int lsi_irq_on_rsl(LSIState *s) 309 { 310 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE); 311 } 312 313 static void lsi_soft_reset(LSIState *s) 314 { 315 DPRINTF("Reset\n"); 316 s->carry = 0; 317 318 s->msg_action = 0; 319 s->msg_len = 0; 320 s->waiting = 0; 321 s->dsa = 0; 322 s->dnad = 0; 323 s->dbc = 0; 324 s->temp = 0; 325 memset(s->scratch, 0, sizeof(s->scratch)); 326 s->istat0 = 0; 327 s->istat1 = 0; 328 s->dcmd = 0x40; 329 s->dstat = 0; 330 s->dien = 0; 331 s->sist0 = 0; 332 s->sist1 = 0; 333 s->sien0 = 0; 334 s->sien1 = 0; 335 s->mbox0 = 0; 336 s->mbox1 = 0; 337 s->dfifo = 0; 338 s->ctest2 = LSI_CTEST2_DACK; 339 s->ctest3 = 0; 340 s->ctest4 = 0; 341 s->ctest5 = 0; 342 s->ccntl0 = 0; 343 s->ccntl1 = 0; 344 s->dsp = 0; 345 s->dsps = 0; 346 s->dmode = 0; 347 s->dcntl = 0; 348 s->scntl0 = 0xc0; 349 s->scntl1 = 0; 350 s->scntl2 = 0; 351 s->scntl3 = 0; 352 s->sstat0 = 0; 353 s->sstat1 = 0; 354 s->scid = 7; 355 s->sxfer = 0; 356 s->socl = 0; 357 s->sdid = 0; 358 s->ssid = 0; 359 s->stest1 = 0; 360 s->stest2 = 0; 361 s->stest3 = 0; 362 s->sidl = 0; 363 s->stime0 = 0; 364 s->respid0 = 0x80; 365 s->respid1 = 0; 366 s->mmrs = 0; 367 s->mmws = 0; 368 s->sfs = 0; 369 s->drs = 0; 370 s->sbms = 0; 371 s->dbms = 0; 372 s->dnad64 = 0; 373 s->pmjad1 = 0; 374 s->pmjad2 = 0; 375 s->rbc = 0; 376 s->ua = 0; 377 s->ia = 0; 378 s->sbc = 0; 379 s->csbc = 0; 380 s->sbr = 0; 381 assert(QTAILQ_EMPTY(&s->queue)); 382 assert(!s->current); 383 } 384 385 static int lsi_dma_40bit(LSIState *s) 386 { 387 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT) 388 return 1; 389 return 0; 390 } 391 392 static int lsi_dma_ti64bit(LSIState *s) 393 { 394 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV) 395 return 1; 396 return 0; 397 } 398 399 static int lsi_dma_64bit(LSIState *s) 400 { 401 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV) 402 return 1; 403 return 0; 404 } 405 406 static uint8_t lsi_reg_readb(LSIState *s, int offset); 407 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val); 408 static void lsi_execute_script(LSIState *s); 409 static void lsi_reselect(LSIState *s, lsi_request *p); 410 411 static inline void lsi_mem_read(LSIState *s, dma_addr_t addr, 412 void *buf, dma_addr_t len) 413 { 414 if (s->dmode & LSI_DMODE_SIOM) { 415 address_space_read(&s->pci_io_as, addr, MEMTXATTRS_UNSPECIFIED, 416 buf, len); 417 } else { 418 pci_dma_read(PCI_DEVICE(s), addr, buf, len); 419 } 420 } 421 422 static inline void lsi_mem_write(LSIState *s, dma_addr_t addr, 423 const void *buf, dma_addr_t len) 424 { 425 if (s->dmode & LSI_DMODE_DIOM) { 426 address_space_write(&s->pci_io_as, addr, MEMTXATTRS_UNSPECIFIED, 427 buf, len); 428 } else { 429 pci_dma_write(PCI_DEVICE(s), addr, buf, len); 430 } 431 } 432 433 static inline uint32_t read_dword(LSIState *s, uint32_t addr) 434 { 435 uint32_t buf; 436 437 pci_dma_read(PCI_DEVICE(s), addr, &buf, 4); 438 return cpu_to_le32(buf); 439 } 440 441 static void lsi_stop_script(LSIState *s) 442 { 443 s->istat1 &= ~LSI_ISTAT1_SRUN; 444 } 445 446 static void lsi_update_irq(LSIState *s) 447 { 448 PCIDevice *d = PCI_DEVICE(s); 449 int level; 450 static int last_level; 451 lsi_request *p; 452 453 /* It's unclear whether the DIP/SIP bits should be cleared when the 454 Interrupt Status Registers are cleared or when istat0 is read. 455 We currently do the formwer, which seems to work. */ 456 level = 0; 457 if (s->dstat) { 458 if (s->dstat & s->dien) 459 level = 1; 460 s->istat0 |= LSI_ISTAT0_DIP; 461 } else { 462 s->istat0 &= ~LSI_ISTAT0_DIP; 463 } 464 465 if (s->sist0 || s->sist1) { 466 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1)) 467 level = 1; 468 s->istat0 |= LSI_ISTAT0_SIP; 469 } else { 470 s->istat0 &= ~LSI_ISTAT0_SIP; 471 } 472 if (s->istat0 & LSI_ISTAT0_INTF) 473 level = 1; 474 475 if (level != last_level) { 476 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n", 477 level, s->dstat, s->sist1, s->sist0); 478 last_level = level; 479 } 480 pci_set_irq(d, level); 481 482 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) { 483 DPRINTF("Handled IRQs & disconnected, looking for pending " 484 "processes\n"); 485 QTAILQ_FOREACH(p, &s->queue, next) { 486 if (p->pending) { 487 lsi_reselect(s, p); 488 break; 489 } 490 } 491 } 492 } 493 494 /* Stop SCRIPTS execution and raise a SCSI interrupt. */ 495 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1) 496 { 497 uint32_t mask0; 498 uint32_t mask1; 499 500 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n", 501 stat1, stat0, s->sist1, s->sist0); 502 s->sist0 |= stat0; 503 s->sist1 |= stat1; 504 /* Stop processor on fatal or unmasked interrupt. As a special hack 505 we don't stop processing when raising STO. Instead continue 506 execution and stop at the next insn that accesses the SCSI bus. */ 507 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL); 508 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH); 509 mask1 &= ~LSI_SIST1_STO; 510 if (s->sist0 & mask0 || s->sist1 & mask1) { 511 lsi_stop_script(s); 512 } 513 lsi_update_irq(s); 514 } 515 516 /* Stop SCRIPTS execution and raise a DMA interrupt. */ 517 static void lsi_script_dma_interrupt(LSIState *s, int stat) 518 { 519 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat); 520 s->dstat |= stat; 521 lsi_update_irq(s); 522 lsi_stop_script(s); 523 } 524 525 static inline void lsi_set_phase(LSIState *s, int phase) 526 { 527 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase; 528 } 529 530 static void lsi_bad_phase(LSIState *s, int out, int new_phase) 531 { 532 /* Trigger a phase mismatch. */ 533 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) { 534 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) { 535 s->dsp = out ? s->pmjad1 : s->pmjad2; 536 } else { 537 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1); 538 } 539 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp); 540 } else { 541 DPRINTF("Phase mismatch interrupt\n"); 542 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0); 543 lsi_stop_script(s); 544 } 545 lsi_set_phase(s, new_phase); 546 } 547 548 549 /* Resume SCRIPTS execution after a DMA operation. */ 550 static void lsi_resume_script(LSIState *s) 551 { 552 if (s->waiting != 2) { 553 s->waiting = 0; 554 lsi_execute_script(s); 555 } else { 556 s->waiting = 0; 557 } 558 } 559 560 static void lsi_disconnect(LSIState *s) 561 { 562 s->scntl1 &= ~LSI_SCNTL1_CON; 563 s->sstat1 &= ~PHASE_MASK; 564 } 565 566 static void lsi_bad_selection(LSIState *s, uint32_t id) 567 { 568 DPRINTF("Selected absent target %d\n", id); 569 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO); 570 lsi_disconnect(s); 571 } 572 573 /* Initiate a SCSI layer data transfer. */ 574 static void lsi_do_dma(LSIState *s, int out) 575 { 576 uint32_t count; 577 dma_addr_t addr; 578 SCSIDevice *dev; 579 580 assert(s->current); 581 if (!s->current->dma_len) { 582 /* Wait until data is available. */ 583 DPRINTF("DMA no data available\n"); 584 return; 585 } 586 587 dev = s->current->req->dev; 588 assert(dev); 589 590 count = s->dbc; 591 if (count > s->current->dma_len) 592 count = s->current->dma_len; 593 594 addr = s->dnad; 595 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */ 596 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s)) 597 addr |= ((uint64_t)s->dnad64 << 32); 598 else if (s->dbms) 599 addr |= ((uint64_t)s->dbms << 32); 600 else if (s->sbms) 601 addr |= ((uint64_t)s->sbms << 32); 602 603 DPRINTF("DMA addr=0x" DMA_ADDR_FMT " len=%d\n", addr, count); 604 s->csbc += count; 605 s->dnad += count; 606 s->dbc -= count; 607 if (s->current->dma_buf == NULL) { 608 s->current->dma_buf = scsi_req_get_buf(s->current->req); 609 } 610 /* ??? Set SFBR to first data byte. */ 611 if (out) { 612 lsi_mem_read(s, addr, s->current->dma_buf, count); 613 } else { 614 lsi_mem_write(s, addr, s->current->dma_buf, count); 615 } 616 s->current->dma_len -= count; 617 if (s->current->dma_len == 0) { 618 s->current->dma_buf = NULL; 619 scsi_req_continue(s->current->req); 620 } else { 621 s->current->dma_buf += count; 622 lsi_resume_script(s); 623 } 624 } 625 626 627 /* Add a command to the queue. */ 628 static void lsi_queue_command(LSIState *s) 629 { 630 lsi_request *p = s->current; 631 632 DPRINTF("Queueing tag=0x%x\n", p->tag); 633 assert(s->current != NULL); 634 assert(s->current->dma_len == 0); 635 QTAILQ_INSERT_TAIL(&s->queue, s->current, next); 636 s->current = NULL; 637 638 p->pending = 0; 639 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO; 640 } 641 642 /* Queue a byte for a MSG IN phase. */ 643 static void lsi_add_msg_byte(LSIState *s, uint8_t data) 644 { 645 if (s->msg_len >= LSI_MAX_MSGIN_LEN) { 646 BADF("MSG IN data too long\n"); 647 } else { 648 DPRINTF("MSG IN 0x%02x\n", data); 649 s->msg[s->msg_len++] = data; 650 } 651 } 652 653 /* Perform reselection to continue a command. */ 654 static void lsi_reselect(LSIState *s, lsi_request *p) 655 { 656 int id; 657 658 assert(s->current == NULL); 659 QTAILQ_REMOVE(&s->queue, p, next); 660 s->current = p; 661 662 id = (p->tag >> 8) & 0xf; 663 s->ssid = id | 0x80; 664 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */ 665 if (!(s->dcntl & LSI_DCNTL_COM)) { 666 s->sfbr = 1 << (id & 0x7); 667 } 668 DPRINTF("Reselected target %d\n", id); 669 s->scntl1 |= LSI_SCNTL1_CON; 670 lsi_set_phase(s, PHASE_MI); 671 s->msg_action = p->out ? 2 : 3; 672 s->current->dma_len = p->pending; 673 lsi_add_msg_byte(s, 0x80); 674 if (s->current->tag & LSI_TAG_VALID) { 675 lsi_add_msg_byte(s, 0x20); 676 lsi_add_msg_byte(s, p->tag & 0xff); 677 } 678 679 if (lsi_irq_on_rsl(s)) { 680 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0); 681 } 682 } 683 684 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag) 685 { 686 lsi_request *p; 687 688 QTAILQ_FOREACH(p, &s->queue, next) { 689 if (p->tag == tag) { 690 return p; 691 } 692 } 693 694 return NULL; 695 } 696 697 static void lsi_request_free(LSIState *s, lsi_request *p) 698 { 699 if (p == s->current) { 700 s->current = NULL; 701 } else { 702 QTAILQ_REMOVE(&s->queue, p, next); 703 } 704 g_free(p); 705 } 706 707 static void lsi_request_cancelled(SCSIRequest *req) 708 { 709 LSIState *s = LSI53C895A(req->bus->qbus.parent); 710 lsi_request *p = req->hba_private; 711 712 req->hba_private = NULL; 713 lsi_request_free(s, p); 714 scsi_req_unref(req); 715 } 716 717 /* Record that data is available for a queued command. Returns zero if 718 the device was reselected, nonzero if the IO is deferred. */ 719 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len) 720 { 721 lsi_request *p = req->hba_private; 722 723 if (p->pending) { 724 BADF("Multiple IO pending for request %p\n", p); 725 } 726 p->pending = len; 727 /* Reselect if waiting for it, or if reselection triggers an IRQ 728 and the bus is free. 729 Since no interrupt stacking is implemented in the emulation, it 730 is also required that there are no pending interrupts waiting 731 for service from the device driver. */ 732 if (s->waiting == 1 || 733 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) && 734 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) { 735 /* Reselect device. */ 736 lsi_reselect(s, p); 737 return 0; 738 } else { 739 DPRINTF("Queueing IO tag=0x%x\n", p->tag); 740 p->pending = len; 741 return 1; 742 } 743 } 744 745 /* Callback to indicate that the SCSI layer has completed a command. */ 746 static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid) 747 { 748 LSIState *s = LSI53C895A(req->bus->qbus.parent); 749 int out; 750 751 out = (s->sstat1 & PHASE_MASK) == PHASE_DO; 752 DPRINTF("Command complete status=%d\n", (int)status); 753 s->status = status; 754 s->command_complete = 2; 755 if (s->waiting && s->dbc != 0) { 756 /* Raise phase mismatch for short transfers. */ 757 lsi_bad_phase(s, out, PHASE_ST); 758 } else { 759 lsi_set_phase(s, PHASE_ST); 760 } 761 762 if (req->hba_private == s->current) { 763 req->hba_private = NULL; 764 lsi_request_free(s, s->current); 765 scsi_req_unref(req); 766 } 767 lsi_resume_script(s); 768 } 769 770 /* Callback to indicate that the SCSI layer has completed a transfer. */ 771 static void lsi_transfer_data(SCSIRequest *req, uint32_t len) 772 { 773 LSIState *s = LSI53C895A(req->bus->qbus.parent); 774 int out; 775 776 assert(req->hba_private); 777 if (s->waiting == 1 || req->hba_private != s->current || 778 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) { 779 if (lsi_queue_req(s, req, len)) { 780 return; 781 } 782 } 783 784 out = (s->sstat1 & PHASE_MASK) == PHASE_DO; 785 786 /* host adapter (re)connected */ 787 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len); 788 s->current->dma_len = len; 789 s->command_complete = 1; 790 if (s->waiting) { 791 if (s->waiting == 1 || s->dbc == 0) { 792 lsi_resume_script(s); 793 } else { 794 lsi_do_dma(s, out); 795 } 796 } 797 } 798 799 static void lsi_do_command(LSIState *s) 800 { 801 SCSIDevice *dev; 802 uint8_t buf[16]; 803 uint32_t id; 804 int n; 805 806 DPRINTF("Send command len=%d\n", s->dbc); 807 if (s->dbc > 16) 808 s->dbc = 16; 809 pci_dma_read(PCI_DEVICE(s), s->dnad, buf, s->dbc); 810 s->sfbr = buf[0]; 811 s->command_complete = 0; 812 813 id = (s->select_tag >> 8) & 0xf; 814 dev = scsi_device_find(&s->bus, 0, id, s->current_lun); 815 if (!dev) { 816 lsi_bad_selection(s, id); 817 return; 818 } 819 820 assert(s->current == NULL); 821 s->current = g_new0(lsi_request, 1); 822 s->current->tag = s->select_tag; 823 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf, 824 s->current); 825 826 n = scsi_req_enqueue(s->current->req); 827 if (n) { 828 if (n > 0) { 829 lsi_set_phase(s, PHASE_DI); 830 } else if (n < 0) { 831 lsi_set_phase(s, PHASE_DO); 832 } 833 scsi_req_continue(s->current->req); 834 } 835 if (!s->command_complete) { 836 if (n) { 837 /* Command did not complete immediately so disconnect. */ 838 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */ 839 lsi_add_msg_byte(s, 4); /* DISCONNECT */ 840 /* wait data */ 841 lsi_set_phase(s, PHASE_MI); 842 s->msg_action = 1; 843 lsi_queue_command(s); 844 } else { 845 /* wait command complete */ 846 lsi_set_phase(s, PHASE_DI); 847 } 848 } 849 } 850 851 static void lsi_do_status(LSIState *s) 852 { 853 uint8_t status; 854 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status); 855 if (s->dbc != 1) 856 BADF("Bad Status move\n"); 857 s->dbc = 1; 858 status = s->status; 859 s->sfbr = status; 860 pci_dma_write(PCI_DEVICE(s), s->dnad, &status, 1); 861 lsi_set_phase(s, PHASE_MI); 862 s->msg_action = 1; 863 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */ 864 } 865 866 static void lsi_do_msgin(LSIState *s) 867 { 868 int len; 869 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len); 870 s->sfbr = s->msg[0]; 871 len = s->msg_len; 872 if (len > s->dbc) 873 len = s->dbc; 874 pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len); 875 /* Linux drivers rely on the last byte being in the SIDL. */ 876 s->sidl = s->msg[len - 1]; 877 s->msg_len -= len; 878 if (s->msg_len) { 879 memmove(s->msg, s->msg + len, s->msg_len); 880 } else { 881 /* ??? Check if ATN (not yet implemented) is asserted and maybe 882 switch to PHASE_MO. */ 883 switch (s->msg_action) { 884 case 0: 885 lsi_set_phase(s, PHASE_CMD); 886 break; 887 case 1: 888 lsi_disconnect(s); 889 break; 890 case 2: 891 lsi_set_phase(s, PHASE_DO); 892 break; 893 case 3: 894 lsi_set_phase(s, PHASE_DI); 895 break; 896 default: 897 abort(); 898 } 899 } 900 } 901 902 /* Read the next byte during a MSGOUT phase. */ 903 static uint8_t lsi_get_msgbyte(LSIState *s) 904 { 905 uint8_t data; 906 pci_dma_read(PCI_DEVICE(s), s->dnad, &data, 1); 907 s->dnad++; 908 s->dbc--; 909 return data; 910 } 911 912 /* Skip the next n bytes during a MSGOUT phase. */ 913 static void lsi_skip_msgbytes(LSIState *s, unsigned int n) 914 { 915 s->dnad += n; 916 s->dbc -= n; 917 } 918 919 static void lsi_do_msgout(LSIState *s) 920 { 921 uint8_t msg; 922 int len; 923 uint32_t current_tag; 924 lsi_request *current_req, *p, *p_next; 925 926 if (s->current) { 927 current_tag = s->current->tag; 928 current_req = s->current; 929 } else { 930 current_tag = s->select_tag; 931 current_req = lsi_find_by_tag(s, current_tag); 932 } 933 934 DPRINTF("MSG out len=%d\n", s->dbc); 935 while (s->dbc) { 936 msg = lsi_get_msgbyte(s); 937 s->sfbr = msg; 938 939 switch (msg) { 940 case 0x04: 941 DPRINTF("MSG: Disconnect\n"); 942 lsi_disconnect(s); 943 break; 944 case 0x08: 945 DPRINTF("MSG: No Operation\n"); 946 lsi_set_phase(s, PHASE_CMD); 947 break; 948 case 0x01: 949 len = lsi_get_msgbyte(s); 950 msg = lsi_get_msgbyte(s); 951 (void)len; /* avoid a warning about unused variable*/ 952 DPRINTF("Extended message 0x%x (len %d)\n", msg, len); 953 switch (msg) { 954 case 1: 955 DPRINTF("SDTR (ignored)\n"); 956 lsi_skip_msgbytes(s, 2); 957 break; 958 case 3: 959 DPRINTF("WDTR (ignored)\n"); 960 lsi_skip_msgbytes(s, 1); 961 break; 962 case 4: 963 DPRINTF("PPR (ignored)\n"); 964 lsi_skip_msgbytes(s, 5); 965 break; 966 default: 967 goto bad; 968 } 969 break; 970 case 0x20: /* SIMPLE queue */ 971 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID; 972 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff); 973 break; 974 case 0x21: /* HEAD of queue */ 975 BADF("HEAD queue not implemented\n"); 976 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID; 977 break; 978 case 0x22: /* ORDERED queue */ 979 BADF("ORDERED queue not implemented\n"); 980 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID; 981 break; 982 case 0x0d: 983 /* The ABORT TAG message clears the current I/O process only. */ 984 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag); 985 if (current_req) { 986 scsi_req_cancel(current_req->req); 987 } 988 lsi_disconnect(s); 989 break; 990 case 0x06: 991 case 0x0e: 992 case 0x0c: 993 /* The ABORT message clears all I/O processes for the selecting 994 initiator on the specified logical unit of the target. */ 995 if (msg == 0x06) { 996 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag); 997 } 998 /* The CLEAR QUEUE message clears all I/O processes for all 999 initiators on the specified logical unit of the target. */ 1000 if (msg == 0x0e) { 1001 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag); 1002 } 1003 /* The BUS DEVICE RESET message clears all I/O processes for all 1004 initiators on all logical units of the target. */ 1005 if (msg == 0x0c) { 1006 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag); 1007 } 1008 1009 /* clear the current I/O process */ 1010 if (s->current) { 1011 scsi_req_cancel(s->current->req); 1012 } 1013 1014 /* As the current implemented devices scsi_disk and scsi_generic 1015 only support one LUN, we don't need to keep track of LUNs. 1016 Clearing I/O processes for other initiators could be possible 1017 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX 1018 device, but this is currently not implemented (and seems not 1019 to be really necessary). So let's simply clear all queued 1020 commands for the current device: */ 1021 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) { 1022 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) { 1023 scsi_req_cancel(p->req); 1024 } 1025 } 1026 1027 lsi_disconnect(s); 1028 break; 1029 default: 1030 if ((msg & 0x80) == 0) { 1031 goto bad; 1032 } 1033 s->current_lun = msg & 7; 1034 DPRINTF("Select LUN %d\n", s->current_lun); 1035 lsi_set_phase(s, PHASE_CMD); 1036 break; 1037 } 1038 } 1039 return; 1040 bad: 1041 BADF("Unimplemented message 0x%02x\n", msg); 1042 lsi_set_phase(s, PHASE_MI); 1043 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */ 1044 s->msg_action = 0; 1045 } 1046 1047 #define LSI_BUF_SIZE 4096 1048 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count) 1049 { 1050 int n; 1051 uint8_t buf[LSI_BUF_SIZE]; 1052 1053 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count); 1054 while (count) { 1055 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count; 1056 lsi_mem_read(s, src, buf, n); 1057 lsi_mem_write(s, dest, buf, n); 1058 src += n; 1059 dest += n; 1060 count -= n; 1061 } 1062 } 1063 1064 static void lsi_wait_reselect(LSIState *s) 1065 { 1066 lsi_request *p; 1067 1068 DPRINTF("Wait Reselect\n"); 1069 1070 QTAILQ_FOREACH(p, &s->queue, next) { 1071 if (p->pending) { 1072 lsi_reselect(s, p); 1073 break; 1074 } 1075 } 1076 if (s->current == NULL) { 1077 s->waiting = 1; 1078 } 1079 } 1080 1081 static void lsi_execute_script(LSIState *s) 1082 { 1083 PCIDevice *pci_dev = PCI_DEVICE(s); 1084 uint32_t insn; 1085 uint32_t addr, addr_high; 1086 int opcode; 1087 int insn_processed = 0; 1088 1089 s->istat1 |= LSI_ISTAT1_SRUN; 1090 again: 1091 insn_processed++; 1092 insn = read_dword(s, s->dsp); 1093 if (!insn) { 1094 /* If we receive an empty opcode increment the DSP by 4 bytes 1095 instead of 8 and execute the next opcode at that location */ 1096 s->dsp += 4; 1097 goto again; 1098 } 1099 addr = read_dword(s, s->dsp + 4); 1100 addr_high = 0; 1101 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr); 1102 s->dsps = addr; 1103 s->dcmd = insn >> 24; 1104 s->dsp += 8; 1105 switch (insn >> 30) { 1106 case 0: /* Block move. */ 1107 if (s->sist1 & LSI_SIST1_STO) { 1108 DPRINTF("Delayed select timeout\n"); 1109 lsi_stop_script(s); 1110 break; 1111 } 1112 s->dbc = insn & 0xffffff; 1113 s->rbc = s->dbc; 1114 /* ??? Set ESA. */ 1115 s->ia = s->dsp - 8; 1116 if (insn & (1 << 29)) { 1117 /* Indirect addressing. */ 1118 addr = read_dword(s, addr); 1119 } else if (insn & (1 << 28)) { 1120 uint32_t buf[2]; 1121 int32_t offset; 1122 /* Table indirect addressing. */ 1123 1124 /* 32-bit Table indirect */ 1125 offset = sextract32(addr, 0, 24); 1126 pci_dma_read(pci_dev, s->dsa + offset, buf, 8); 1127 /* byte count is stored in bits 0:23 only */ 1128 s->dbc = cpu_to_le32(buf[0]) & 0xffffff; 1129 s->rbc = s->dbc; 1130 addr = cpu_to_le32(buf[1]); 1131 1132 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of 1133 * table, bits [31:24] */ 1134 if (lsi_dma_40bit(s)) 1135 addr_high = cpu_to_le32(buf[0]) >> 24; 1136 else if (lsi_dma_ti64bit(s)) { 1137 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f; 1138 switch (selector) { 1139 case 0 ... 0x0f: 1140 /* offset index into scratch registers since 1141 * TI64 mode can use registers C to R */ 1142 addr_high = s->scratch[2 + selector]; 1143 break; 1144 case 0x10: 1145 addr_high = s->mmrs; 1146 break; 1147 case 0x11: 1148 addr_high = s->mmws; 1149 break; 1150 case 0x12: 1151 addr_high = s->sfs; 1152 break; 1153 case 0x13: 1154 addr_high = s->drs; 1155 break; 1156 case 0x14: 1157 addr_high = s->sbms; 1158 break; 1159 case 0x15: 1160 addr_high = s->dbms; 1161 break; 1162 default: 1163 BADF("Illegal selector specified (0x%x > 0x15)" 1164 " for 64-bit DMA block move", selector); 1165 break; 1166 } 1167 } 1168 } else if (lsi_dma_64bit(s)) { 1169 /* fetch a 3rd dword if 64-bit direct move is enabled and 1170 only if we're not doing table indirect or indirect addressing */ 1171 s->dbms = read_dword(s, s->dsp); 1172 s->dsp += 4; 1173 s->ia = s->dsp - 12; 1174 } 1175 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) { 1176 DPRINTF("Wrong phase got %d expected %d\n", 1177 s->sstat1 & PHASE_MASK, (insn >> 24) & 7); 1178 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0); 1179 break; 1180 } 1181 s->dnad = addr; 1182 s->dnad64 = addr_high; 1183 switch (s->sstat1 & 0x7) { 1184 case PHASE_DO: 1185 s->waiting = 2; 1186 lsi_do_dma(s, 1); 1187 if (s->waiting) 1188 s->waiting = 3; 1189 break; 1190 case PHASE_DI: 1191 s->waiting = 2; 1192 lsi_do_dma(s, 0); 1193 if (s->waiting) 1194 s->waiting = 3; 1195 break; 1196 case PHASE_CMD: 1197 lsi_do_command(s); 1198 break; 1199 case PHASE_ST: 1200 lsi_do_status(s); 1201 break; 1202 case PHASE_MO: 1203 lsi_do_msgout(s); 1204 break; 1205 case PHASE_MI: 1206 lsi_do_msgin(s); 1207 break; 1208 default: 1209 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK); 1210 exit(1); 1211 } 1212 s->dfifo = s->dbc & 0xff; 1213 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3); 1214 s->sbc = s->dbc; 1215 s->rbc -= s->dbc; 1216 s->ua = addr + s->dbc; 1217 break; 1218 1219 case 1: /* IO or Read/Write instruction. */ 1220 opcode = (insn >> 27) & 7; 1221 if (opcode < 5) { 1222 uint32_t id; 1223 1224 if (insn & (1 << 25)) { 1225 id = read_dword(s, s->dsa + sextract32(insn, 0, 24)); 1226 } else { 1227 id = insn; 1228 } 1229 id = (id >> 16) & 0xf; 1230 if (insn & (1 << 26)) { 1231 addr = s->dsp + sextract32(addr, 0, 24); 1232 } 1233 s->dnad = addr; 1234 switch (opcode) { 1235 case 0: /* Select */ 1236 s->sdid = id; 1237 if (s->scntl1 & LSI_SCNTL1_CON) { 1238 DPRINTF("Already reselected, jumping to alternative address\n"); 1239 s->dsp = s->dnad; 1240 break; 1241 } 1242 s->sstat0 |= LSI_SSTAT0_WOA; 1243 s->scntl1 &= ~LSI_SCNTL1_IARB; 1244 if (!scsi_device_find(&s->bus, 0, id, 0)) { 1245 lsi_bad_selection(s, id); 1246 break; 1247 } 1248 DPRINTF("Selected target %d%s\n", 1249 id, insn & (1 << 3) ? " ATN" : ""); 1250 /* ??? Linux drivers compain when this is set. Maybe 1251 it only applies in low-level mode (unimplemented). 1252 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */ 1253 s->select_tag = id << 8; 1254 s->scntl1 |= LSI_SCNTL1_CON; 1255 if (insn & (1 << 3)) { 1256 s->socl |= LSI_SOCL_ATN; 1257 } 1258 lsi_set_phase(s, PHASE_MO); 1259 break; 1260 case 1: /* Disconnect */ 1261 DPRINTF("Wait Disconnect\n"); 1262 s->scntl1 &= ~LSI_SCNTL1_CON; 1263 break; 1264 case 2: /* Wait Reselect */ 1265 if (!lsi_irq_on_rsl(s)) { 1266 lsi_wait_reselect(s); 1267 } 1268 break; 1269 case 3: /* Set */ 1270 DPRINTF("Set%s%s%s%s\n", 1271 insn & (1 << 3) ? " ATN" : "", 1272 insn & (1 << 6) ? " ACK" : "", 1273 insn & (1 << 9) ? " TM" : "", 1274 insn & (1 << 10) ? " CC" : ""); 1275 if (insn & (1 << 3)) { 1276 s->socl |= LSI_SOCL_ATN; 1277 lsi_set_phase(s, PHASE_MO); 1278 } 1279 if (insn & (1 << 9)) { 1280 BADF("Target mode not implemented\n"); 1281 exit(1); 1282 } 1283 if (insn & (1 << 10)) 1284 s->carry = 1; 1285 break; 1286 case 4: /* Clear */ 1287 DPRINTF("Clear%s%s%s%s\n", 1288 insn & (1 << 3) ? " ATN" : "", 1289 insn & (1 << 6) ? " ACK" : "", 1290 insn & (1 << 9) ? " TM" : "", 1291 insn & (1 << 10) ? " CC" : ""); 1292 if (insn & (1 << 3)) { 1293 s->socl &= ~LSI_SOCL_ATN; 1294 } 1295 if (insn & (1 << 10)) 1296 s->carry = 0; 1297 break; 1298 } 1299 } else { 1300 uint8_t op0; 1301 uint8_t op1; 1302 uint8_t data8; 1303 int reg; 1304 int operator; 1305 #ifdef DEBUG_LSI 1306 static const char *opcode_names[3] = 1307 {"Write", "Read", "Read-Modify-Write"}; 1308 static const char *operator_names[8] = 1309 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"}; 1310 #endif 1311 1312 reg = ((insn >> 16) & 0x7f) | (insn & 0x80); 1313 data8 = (insn >> 8) & 0xff; 1314 opcode = (insn >> 27) & 7; 1315 operator = (insn >> 24) & 7; 1316 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n", 1317 opcode_names[opcode - 5], reg, 1318 operator_names[operator], data8, s->sfbr, 1319 (insn & (1 << 23)) ? " SFBR" : ""); 1320 op0 = op1 = 0; 1321 switch (opcode) { 1322 case 5: /* From SFBR */ 1323 op0 = s->sfbr; 1324 op1 = data8; 1325 break; 1326 case 6: /* To SFBR */ 1327 if (operator) 1328 op0 = lsi_reg_readb(s, reg); 1329 op1 = data8; 1330 break; 1331 case 7: /* Read-modify-write */ 1332 if (operator) 1333 op0 = lsi_reg_readb(s, reg); 1334 if (insn & (1 << 23)) { 1335 op1 = s->sfbr; 1336 } else { 1337 op1 = data8; 1338 } 1339 break; 1340 } 1341 1342 switch (operator) { 1343 case 0: /* move */ 1344 op0 = op1; 1345 break; 1346 case 1: /* Shift left */ 1347 op1 = op0 >> 7; 1348 op0 = (op0 << 1) | s->carry; 1349 s->carry = op1; 1350 break; 1351 case 2: /* OR */ 1352 op0 |= op1; 1353 break; 1354 case 3: /* XOR */ 1355 op0 ^= op1; 1356 break; 1357 case 4: /* AND */ 1358 op0 &= op1; 1359 break; 1360 case 5: /* SHR */ 1361 op1 = op0 & 1; 1362 op0 = (op0 >> 1) | (s->carry << 7); 1363 s->carry = op1; 1364 break; 1365 case 6: /* ADD */ 1366 op0 += op1; 1367 s->carry = op0 < op1; 1368 break; 1369 case 7: /* ADC */ 1370 op0 += op1 + s->carry; 1371 if (s->carry) 1372 s->carry = op0 <= op1; 1373 else 1374 s->carry = op0 < op1; 1375 break; 1376 } 1377 1378 switch (opcode) { 1379 case 5: /* From SFBR */ 1380 case 7: /* Read-modify-write */ 1381 lsi_reg_writeb(s, reg, op0); 1382 break; 1383 case 6: /* To SFBR */ 1384 s->sfbr = op0; 1385 break; 1386 } 1387 } 1388 break; 1389 1390 case 2: /* Transfer Control. */ 1391 { 1392 int cond; 1393 int jmp; 1394 1395 if ((insn & 0x002e0000) == 0) { 1396 DPRINTF("NOP\n"); 1397 break; 1398 } 1399 if (s->sist1 & LSI_SIST1_STO) { 1400 DPRINTF("Delayed select timeout\n"); 1401 lsi_stop_script(s); 1402 break; 1403 } 1404 cond = jmp = (insn & (1 << 19)) != 0; 1405 if (cond == jmp && (insn & (1 << 21))) { 1406 DPRINTF("Compare carry %d\n", s->carry == jmp); 1407 cond = s->carry != 0; 1408 } 1409 if (cond == jmp && (insn & (1 << 17))) { 1410 DPRINTF("Compare phase %d %c= %d\n", 1411 (s->sstat1 & PHASE_MASK), 1412 jmp ? '=' : '!', 1413 ((insn >> 24) & 7)); 1414 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7); 1415 } 1416 if (cond == jmp && (insn & (1 << 18))) { 1417 uint8_t mask; 1418 1419 mask = (~insn >> 8) & 0xff; 1420 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n", 1421 s->sfbr, mask, jmp ? '=' : '!', insn & mask); 1422 cond = (s->sfbr & mask) == (insn & mask); 1423 } 1424 if (cond == jmp) { 1425 if (insn & (1 << 23)) { 1426 /* Relative address. */ 1427 addr = s->dsp + sextract32(addr, 0, 24); 1428 } 1429 switch ((insn >> 27) & 7) { 1430 case 0: /* Jump */ 1431 DPRINTF("Jump to 0x%08x\n", addr); 1432 s->adder = addr; 1433 s->dsp = addr; 1434 break; 1435 case 1: /* Call */ 1436 DPRINTF("Call 0x%08x\n", addr); 1437 s->temp = s->dsp; 1438 s->dsp = addr; 1439 break; 1440 case 2: /* Return */ 1441 DPRINTF("Return to 0x%08x\n", s->temp); 1442 s->dsp = s->temp; 1443 break; 1444 case 3: /* Interrupt */ 1445 DPRINTF("Interrupt 0x%08x\n", s->dsps); 1446 if ((insn & (1 << 20)) != 0) { 1447 s->istat0 |= LSI_ISTAT0_INTF; 1448 lsi_update_irq(s); 1449 } else { 1450 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR); 1451 } 1452 break; 1453 default: 1454 DPRINTF("Illegal transfer control\n"); 1455 lsi_script_dma_interrupt(s, LSI_DSTAT_IID); 1456 break; 1457 } 1458 } else { 1459 DPRINTF("Control condition failed\n"); 1460 } 1461 } 1462 break; 1463 1464 case 3: 1465 if ((insn & (1 << 29)) == 0) { 1466 /* Memory move. */ 1467 uint32_t dest; 1468 /* ??? The docs imply the destination address is loaded into 1469 the TEMP register. However the Linux drivers rely on 1470 the value being presrved. */ 1471 dest = read_dword(s, s->dsp); 1472 s->dsp += 4; 1473 lsi_memcpy(s, dest, addr, insn & 0xffffff); 1474 } else { 1475 uint8_t data[7]; 1476 int reg; 1477 int n; 1478 int i; 1479 1480 if (insn & (1 << 28)) { 1481 addr = s->dsa + sextract32(addr, 0, 24); 1482 } 1483 n = (insn & 7); 1484 reg = (insn >> 16) & 0xff; 1485 if (insn & (1 << 24)) { 1486 pci_dma_read(pci_dev, addr, data, n); 1487 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n, 1488 addr, *(int *)data); 1489 for (i = 0; i < n; i++) { 1490 lsi_reg_writeb(s, reg + i, data[i]); 1491 } 1492 } else { 1493 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr); 1494 for (i = 0; i < n; i++) { 1495 data[i] = lsi_reg_readb(s, reg + i); 1496 } 1497 pci_dma_write(pci_dev, addr, data, n); 1498 } 1499 } 1500 } 1501 if (insn_processed > 10000 && !s->waiting) { 1502 /* Some windows drivers make the device spin waiting for a memory 1503 location to change. If we have been executed a lot of code then 1504 assume this is the case and force an unexpected device disconnect. 1505 This is apparently sufficient to beat the drivers into submission. 1506 */ 1507 if (!(s->sien0 & LSI_SIST0_UDC)) 1508 fprintf(stderr, "inf. loop with UDC masked\n"); 1509 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0); 1510 lsi_disconnect(s); 1511 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) { 1512 if (s->dcntl & LSI_DCNTL_SSM) { 1513 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI); 1514 } else { 1515 goto again; 1516 } 1517 } 1518 DPRINTF("SCRIPTS execution stopped\n"); 1519 } 1520 1521 static uint8_t lsi_reg_readb(LSIState *s, int offset) 1522 { 1523 uint8_t ret; 1524 1525 #define CASE_GET_REG24(name, addr) \ 1526 case addr: ret = s->name & 0xff; break; \ 1527 case addr + 1: ret = (s->name >> 8) & 0xff; break; \ 1528 case addr + 2: ret = (s->name >> 16) & 0xff; break; 1529 1530 #define CASE_GET_REG32(name, addr) \ 1531 case addr: ret = s->name & 0xff; break; \ 1532 case addr + 1: ret = (s->name >> 8) & 0xff; break; \ 1533 case addr + 2: ret = (s->name >> 16) & 0xff; break; \ 1534 case addr + 3: ret = (s->name >> 24) & 0xff; break; 1535 1536 switch (offset) { 1537 case 0x00: /* SCNTL0 */ 1538 ret = s->scntl0; 1539 break; 1540 case 0x01: /* SCNTL1 */ 1541 ret = s->scntl1; 1542 break; 1543 case 0x02: /* SCNTL2 */ 1544 ret = s->scntl2; 1545 break; 1546 case 0x03: /* SCNTL3 */ 1547 ret = s->scntl3; 1548 break; 1549 case 0x04: /* SCID */ 1550 ret = s->scid; 1551 break; 1552 case 0x05: /* SXFER */ 1553 ret = s->sxfer; 1554 break; 1555 case 0x06: /* SDID */ 1556 ret = s->sdid; 1557 break; 1558 case 0x07: /* GPREG0 */ 1559 ret = 0x7f; 1560 break; 1561 case 0x08: /* Revision ID */ 1562 ret = 0x00; 1563 break; 1564 case 0x09: /* SOCL */ 1565 ret = s->socl; 1566 break; 1567 case 0xa: /* SSID */ 1568 ret = s->ssid; 1569 break; 1570 case 0xb: /* SBCL */ 1571 /* ??? This is not correct. However it's (hopefully) only 1572 used for diagnostics, so should be ok. */ 1573 ret = 0; 1574 break; 1575 case 0xc: /* DSTAT */ 1576 ret = s->dstat | LSI_DSTAT_DFE; 1577 if ((s->istat0 & LSI_ISTAT0_INTF) == 0) 1578 s->dstat = 0; 1579 lsi_update_irq(s); 1580 break; 1581 case 0x0d: /* SSTAT0 */ 1582 ret = s->sstat0; 1583 break; 1584 case 0x0e: /* SSTAT1 */ 1585 ret = s->sstat1; 1586 break; 1587 case 0x0f: /* SSTAT2 */ 1588 ret = s->scntl1 & LSI_SCNTL1_CON ? 0 : 2; 1589 break; 1590 CASE_GET_REG32(dsa, 0x10) 1591 case 0x14: /* ISTAT0 */ 1592 ret = s->istat0; 1593 break; 1594 case 0x15: /* ISTAT1 */ 1595 ret = s->istat1; 1596 break; 1597 case 0x16: /* MBOX0 */ 1598 ret = s->mbox0; 1599 break; 1600 case 0x17: /* MBOX1 */ 1601 ret = s->mbox1; 1602 break; 1603 case 0x18: /* CTEST0 */ 1604 ret = 0xff; 1605 break; 1606 case 0x19: /* CTEST1 */ 1607 ret = 0; 1608 break; 1609 case 0x1a: /* CTEST2 */ 1610 ret = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM; 1611 if (s->istat0 & LSI_ISTAT0_SIGP) { 1612 s->istat0 &= ~LSI_ISTAT0_SIGP; 1613 ret |= LSI_CTEST2_SIGP; 1614 } 1615 break; 1616 case 0x1b: /* CTEST3 */ 1617 ret = s->ctest3; 1618 break; 1619 CASE_GET_REG32(temp, 0x1c) 1620 case 0x20: /* DFIFO */ 1621 ret = 0; 1622 break; 1623 case 0x21: /* CTEST4 */ 1624 ret = s->ctest4; 1625 break; 1626 case 0x22: /* CTEST5 */ 1627 ret = s->ctest5; 1628 break; 1629 case 0x23: /* CTEST6 */ 1630 ret = 0; 1631 break; 1632 CASE_GET_REG24(dbc, 0x24) 1633 case 0x27: /* DCMD */ 1634 ret = s->dcmd; 1635 break; 1636 CASE_GET_REG32(dnad, 0x28) 1637 CASE_GET_REG32(dsp, 0x2c) 1638 CASE_GET_REG32(dsps, 0x30) 1639 CASE_GET_REG32(scratch[0], 0x34) 1640 case 0x38: /* DMODE */ 1641 ret = s->dmode; 1642 break; 1643 case 0x39: /* DIEN */ 1644 ret = s->dien; 1645 break; 1646 case 0x3a: /* SBR */ 1647 ret = s->sbr; 1648 break; 1649 case 0x3b: /* DCNTL */ 1650 ret = s->dcntl; 1651 break; 1652 /* ADDER Output (Debug of relative jump address) */ 1653 CASE_GET_REG32(adder, 0x3c) 1654 case 0x40: /* SIEN0 */ 1655 ret = s->sien0; 1656 break; 1657 case 0x41: /* SIEN1 */ 1658 ret = s->sien1; 1659 break; 1660 case 0x42: /* SIST0 */ 1661 ret = s->sist0; 1662 s->sist0 = 0; 1663 lsi_update_irq(s); 1664 break; 1665 case 0x43: /* SIST1 */ 1666 ret = s->sist1; 1667 s->sist1 = 0; 1668 lsi_update_irq(s); 1669 break; 1670 case 0x46: /* MACNTL */ 1671 ret = 0x0f; 1672 break; 1673 case 0x47: /* GPCNTL0 */ 1674 ret = 0x0f; 1675 break; 1676 case 0x48: /* STIME0 */ 1677 ret = s->stime0; 1678 break; 1679 case 0x4a: /* RESPID0 */ 1680 ret = s->respid0; 1681 break; 1682 case 0x4b: /* RESPID1 */ 1683 ret = s->respid1; 1684 break; 1685 case 0x4d: /* STEST1 */ 1686 ret = s->stest1; 1687 break; 1688 case 0x4e: /* STEST2 */ 1689 ret = s->stest2; 1690 break; 1691 case 0x4f: /* STEST3 */ 1692 ret = s->stest3; 1693 break; 1694 case 0x50: /* SIDL */ 1695 /* This is needed by the linux drivers. We currently only update it 1696 during the MSG IN phase. */ 1697 ret = s->sidl; 1698 break; 1699 case 0x52: /* STEST4 */ 1700 ret = 0xe0; 1701 break; 1702 case 0x56: /* CCNTL0 */ 1703 ret = s->ccntl0; 1704 break; 1705 case 0x57: /* CCNTL1 */ 1706 ret = s->ccntl1; 1707 break; 1708 case 0x58: /* SBDL */ 1709 /* Some drivers peek at the data bus during the MSG IN phase. */ 1710 if ((s->sstat1 & PHASE_MASK) == PHASE_MI) 1711 return s->msg[0]; 1712 ret = 0; 1713 break; 1714 case 0x59: /* SBDL high */ 1715 ret = 0; 1716 break; 1717 CASE_GET_REG32(mmrs, 0xa0) 1718 CASE_GET_REG32(mmws, 0xa4) 1719 CASE_GET_REG32(sfs, 0xa8) 1720 CASE_GET_REG32(drs, 0xac) 1721 CASE_GET_REG32(sbms, 0xb0) 1722 CASE_GET_REG32(dbms, 0xb4) 1723 CASE_GET_REG32(dnad64, 0xb8) 1724 CASE_GET_REG32(pmjad1, 0xc0) 1725 CASE_GET_REG32(pmjad2, 0xc4) 1726 CASE_GET_REG32(rbc, 0xc8) 1727 CASE_GET_REG32(ua, 0xcc) 1728 CASE_GET_REG32(ia, 0xd4) 1729 CASE_GET_REG32(sbc, 0xd8) 1730 CASE_GET_REG32(csbc, 0xdc) 1731 case 0x5c ... 0x9f: 1732 { 1733 int n; 1734 int shift; 1735 n = (offset - 0x58) >> 2; 1736 shift = (offset & 3) * 8; 1737 ret = (s->scratch[n] >> shift) & 0xff; 1738 break; 1739 } 1740 default: 1741 { 1742 qemu_log_mask(LOG_GUEST_ERROR, 1743 "lsi_scsi: invalid read from reg %s %x\n", 1744 offset < ARRAY_SIZE(names) ? names[offset] : "???", 1745 offset); 1746 ret = 0xff; 1747 break; 1748 } 1749 } 1750 #undef CASE_GET_REG24 1751 #undef CASE_GET_REG32 1752 1753 #ifdef DEBUG_LSI_REG 1754 DPRINTF("Read reg %s %x = %02x\n", 1755 offset < ARRAY_SIZE(names) ? names[offset] : "???", offset, ret); 1756 #endif 1757 1758 return ret; 1759 } 1760 1761 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val) 1762 { 1763 #define CASE_SET_REG24(name, addr) \ 1764 case addr : s->name &= 0xffffff00; s->name |= val; break; \ 1765 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \ 1766 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; 1767 1768 #define CASE_SET_REG32(name, addr) \ 1769 case addr : s->name &= 0xffffff00; s->name |= val; break; \ 1770 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \ 1771 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \ 1772 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break; 1773 1774 #ifdef DEBUG_LSI_REG 1775 DPRINTF("Write reg %s %x = %02x\n", 1776 offset < ARRAY_SIZE(names) ? names[offset] : "???", offset, val); 1777 #endif 1778 switch (offset) { 1779 case 0x00: /* SCNTL0 */ 1780 s->scntl0 = val; 1781 if (val & LSI_SCNTL0_START) { 1782 BADF("Start sequence not implemented\n"); 1783 } 1784 break; 1785 case 0x01: /* SCNTL1 */ 1786 s->scntl1 = val & ~LSI_SCNTL1_SST; 1787 if (val & LSI_SCNTL1_IARB) { 1788 BADF("Immediate Arbritration not implemented\n"); 1789 } 1790 if (val & LSI_SCNTL1_RST) { 1791 if (!(s->sstat0 & LSI_SSTAT0_RST)) { 1792 qbus_reset_all(&s->bus.qbus); 1793 s->sstat0 |= LSI_SSTAT0_RST; 1794 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0); 1795 } 1796 } else { 1797 s->sstat0 &= ~LSI_SSTAT0_RST; 1798 } 1799 break; 1800 case 0x02: /* SCNTL2 */ 1801 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS); 1802 s->scntl2 = val; 1803 break; 1804 case 0x03: /* SCNTL3 */ 1805 s->scntl3 = val; 1806 break; 1807 case 0x04: /* SCID */ 1808 s->scid = val; 1809 break; 1810 case 0x05: /* SXFER */ 1811 s->sxfer = val; 1812 break; 1813 case 0x06: /* SDID */ 1814 if ((s->ssid & 0x80) && (val & 0xf) != (s->ssid & 0xf)) { 1815 BADF("Destination ID does not match SSID\n"); 1816 } 1817 s->sdid = val & 0xf; 1818 break; 1819 case 0x07: /* GPREG0 */ 1820 break; 1821 case 0x08: /* SFBR */ 1822 /* The CPU is not allowed to write to this register. However the 1823 SCRIPTS register move instructions are. */ 1824 s->sfbr = val; 1825 break; 1826 case 0x0a: case 0x0b: 1827 /* Openserver writes to these readonly registers on startup */ 1828 return; 1829 case 0x0c: case 0x0d: case 0x0e: case 0x0f: 1830 /* Linux writes to these readonly registers on startup. */ 1831 return; 1832 CASE_SET_REG32(dsa, 0x10) 1833 case 0x14: /* ISTAT0 */ 1834 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0); 1835 if (val & LSI_ISTAT0_ABRT) { 1836 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT); 1837 } 1838 if (val & LSI_ISTAT0_INTF) { 1839 s->istat0 &= ~LSI_ISTAT0_INTF; 1840 lsi_update_irq(s); 1841 } 1842 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) { 1843 DPRINTF("Woken by SIGP\n"); 1844 s->waiting = 0; 1845 s->dsp = s->dnad; 1846 lsi_execute_script(s); 1847 } 1848 if (val & LSI_ISTAT0_SRST) { 1849 qdev_reset_all(DEVICE(s)); 1850 } 1851 break; 1852 case 0x16: /* MBOX0 */ 1853 s->mbox0 = val; 1854 break; 1855 case 0x17: /* MBOX1 */ 1856 s->mbox1 = val; 1857 break; 1858 case 0x18: /* CTEST0 */ 1859 /* nothing to do */ 1860 break; 1861 case 0x1a: /* CTEST2 */ 1862 s->ctest2 = val & LSI_CTEST2_PCICIE; 1863 break; 1864 case 0x1b: /* CTEST3 */ 1865 s->ctest3 = val & 0x0f; 1866 break; 1867 CASE_SET_REG32(temp, 0x1c) 1868 case 0x21: /* CTEST4 */ 1869 if (val & 7) { 1870 BADF("Unimplemented CTEST4-FBL 0x%x\n", val); 1871 } 1872 s->ctest4 = val; 1873 break; 1874 case 0x22: /* CTEST5 */ 1875 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) { 1876 BADF("CTEST5 DMA increment not implemented\n"); 1877 } 1878 s->ctest5 = val; 1879 break; 1880 CASE_SET_REG24(dbc, 0x24) 1881 CASE_SET_REG32(dnad, 0x28) 1882 case 0x2c: /* DSP[0:7] */ 1883 s->dsp &= 0xffffff00; 1884 s->dsp |= val; 1885 break; 1886 case 0x2d: /* DSP[8:15] */ 1887 s->dsp &= 0xffff00ff; 1888 s->dsp |= val << 8; 1889 break; 1890 case 0x2e: /* DSP[16:23] */ 1891 s->dsp &= 0xff00ffff; 1892 s->dsp |= val << 16; 1893 break; 1894 case 0x2f: /* DSP[24:31] */ 1895 s->dsp &= 0x00ffffff; 1896 s->dsp |= val << 24; 1897 if ((s->dmode & LSI_DMODE_MAN) == 0 1898 && (s->istat1 & LSI_ISTAT1_SRUN) == 0) 1899 lsi_execute_script(s); 1900 break; 1901 CASE_SET_REG32(dsps, 0x30) 1902 CASE_SET_REG32(scratch[0], 0x34) 1903 case 0x38: /* DMODE */ 1904 s->dmode = val; 1905 break; 1906 case 0x39: /* DIEN */ 1907 s->dien = val; 1908 lsi_update_irq(s); 1909 break; 1910 case 0x3a: /* SBR */ 1911 s->sbr = val; 1912 break; 1913 case 0x3b: /* DCNTL */ 1914 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD); 1915 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0) 1916 lsi_execute_script(s); 1917 break; 1918 case 0x40: /* SIEN0 */ 1919 s->sien0 = val; 1920 lsi_update_irq(s); 1921 break; 1922 case 0x41: /* SIEN1 */ 1923 s->sien1 = val; 1924 lsi_update_irq(s); 1925 break; 1926 case 0x47: /* GPCNTL0 */ 1927 break; 1928 case 0x48: /* STIME0 */ 1929 s->stime0 = val; 1930 break; 1931 case 0x49: /* STIME1 */ 1932 if (val & 0xf) { 1933 DPRINTF("General purpose timer not implemented\n"); 1934 /* ??? Raising the interrupt immediately seems to be sufficient 1935 to keep the FreeBSD driver happy. */ 1936 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN); 1937 } 1938 break; 1939 case 0x4a: /* RESPID0 */ 1940 s->respid0 = val; 1941 break; 1942 case 0x4b: /* RESPID1 */ 1943 s->respid1 = val; 1944 break; 1945 case 0x4d: /* STEST1 */ 1946 s->stest1 = val; 1947 break; 1948 case 0x4e: /* STEST2 */ 1949 if (val & 1) { 1950 BADF("Low level mode not implemented\n"); 1951 } 1952 s->stest2 = val; 1953 break; 1954 case 0x4f: /* STEST3 */ 1955 if (val & 0x41) { 1956 BADF("SCSI FIFO test mode not implemented\n"); 1957 } 1958 s->stest3 = val; 1959 break; 1960 case 0x56: /* CCNTL0 */ 1961 s->ccntl0 = val; 1962 break; 1963 case 0x57: /* CCNTL1 */ 1964 s->ccntl1 = val; 1965 break; 1966 CASE_SET_REG32(mmrs, 0xa0) 1967 CASE_SET_REG32(mmws, 0xa4) 1968 CASE_SET_REG32(sfs, 0xa8) 1969 CASE_SET_REG32(drs, 0xac) 1970 CASE_SET_REG32(sbms, 0xb0) 1971 CASE_SET_REG32(dbms, 0xb4) 1972 CASE_SET_REG32(dnad64, 0xb8) 1973 CASE_SET_REG32(pmjad1, 0xc0) 1974 CASE_SET_REG32(pmjad2, 0xc4) 1975 CASE_SET_REG32(rbc, 0xc8) 1976 CASE_SET_REG32(ua, 0xcc) 1977 CASE_SET_REG32(ia, 0xd4) 1978 CASE_SET_REG32(sbc, 0xd8) 1979 CASE_SET_REG32(csbc, 0xdc) 1980 default: 1981 if (offset >= 0x5c && offset < 0xa0) { 1982 int n; 1983 int shift; 1984 n = (offset - 0x58) >> 2; 1985 shift = (offset & 3) * 8; 1986 s->scratch[n] = deposit32(s->scratch[n], shift, 8, val); 1987 } else { 1988 qemu_log_mask(LOG_GUEST_ERROR, 1989 "lsi_scsi: invalid write to reg %s %x (0x%02x)\n", 1990 offset < ARRAY_SIZE(names) ? names[offset] : "???", 1991 offset, val); 1992 } 1993 } 1994 #undef CASE_SET_REG24 1995 #undef CASE_SET_REG32 1996 } 1997 1998 static void lsi_mmio_write(void *opaque, hwaddr addr, 1999 uint64_t val, unsigned size) 2000 { 2001 LSIState *s = opaque; 2002 2003 lsi_reg_writeb(s, addr & 0xff, val); 2004 } 2005 2006 static uint64_t lsi_mmio_read(void *opaque, hwaddr addr, 2007 unsigned size) 2008 { 2009 LSIState *s = opaque; 2010 2011 return lsi_reg_readb(s, addr & 0xff); 2012 } 2013 2014 static const MemoryRegionOps lsi_mmio_ops = { 2015 .read = lsi_mmio_read, 2016 .write = lsi_mmio_write, 2017 .endianness = DEVICE_NATIVE_ENDIAN, 2018 .impl = { 2019 .min_access_size = 1, 2020 .max_access_size = 1, 2021 }, 2022 }; 2023 2024 static void lsi_ram_write(void *opaque, hwaddr addr, 2025 uint64_t val, unsigned size) 2026 { 2027 LSIState *s = opaque; 2028 uint32_t newval; 2029 uint32_t mask; 2030 int shift; 2031 2032 newval = s->script_ram[addr >> 2]; 2033 shift = (addr & 3) * 8; 2034 mask = ((uint64_t)1 << (size * 8)) - 1; 2035 newval &= ~(mask << shift); 2036 newval |= val << shift; 2037 s->script_ram[addr >> 2] = newval; 2038 } 2039 2040 static uint64_t lsi_ram_read(void *opaque, hwaddr addr, 2041 unsigned size) 2042 { 2043 LSIState *s = opaque; 2044 uint32_t val; 2045 uint32_t mask; 2046 2047 val = s->script_ram[addr >> 2]; 2048 mask = ((uint64_t)1 << (size * 8)) - 1; 2049 val >>= (addr & 3) * 8; 2050 return val & mask; 2051 } 2052 2053 static const MemoryRegionOps lsi_ram_ops = { 2054 .read = lsi_ram_read, 2055 .write = lsi_ram_write, 2056 .endianness = DEVICE_NATIVE_ENDIAN, 2057 }; 2058 2059 static uint64_t lsi_io_read(void *opaque, hwaddr addr, 2060 unsigned size) 2061 { 2062 LSIState *s = opaque; 2063 return lsi_reg_readb(s, addr & 0xff); 2064 } 2065 2066 static void lsi_io_write(void *opaque, hwaddr addr, 2067 uint64_t val, unsigned size) 2068 { 2069 LSIState *s = opaque; 2070 lsi_reg_writeb(s, addr & 0xff, val); 2071 } 2072 2073 static const MemoryRegionOps lsi_io_ops = { 2074 .read = lsi_io_read, 2075 .write = lsi_io_write, 2076 .endianness = DEVICE_NATIVE_ENDIAN, 2077 .impl = { 2078 .min_access_size = 1, 2079 .max_access_size = 1, 2080 }, 2081 }; 2082 2083 static void lsi_scsi_reset(DeviceState *dev) 2084 { 2085 LSIState *s = LSI53C895A(dev); 2086 2087 lsi_soft_reset(s); 2088 } 2089 2090 static int lsi_pre_save(void *opaque) 2091 { 2092 LSIState *s = opaque; 2093 2094 if (s->current) { 2095 assert(s->current->dma_buf == NULL); 2096 assert(s->current->dma_len == 0); 2097 } 2098 assert(QTAILQ_EMPTY(&s->queue)); 2099 2100 return 0; 2101 } 2102 2103 static const VMStateDescription vmstate_lsi_scsi = { 2104 .name = "lsiscsi", 2105 .version_id = 0, 2106 .minimum_version_id = 0, 2107 .pre_save = lsi_pre_save, 2108 .fields = (VMStateField[]) { 2109 VMSTATE_PCI_DEVICE(parent_obj, LSIState), 2110 2111 VMSTATE_INT32(carry, LSIState), 2112 VMSTATE_INT32(status, LSIState), 2113 VMSTATE_INT32(msg_action, LSIState), 2114 VMSTATE_INT32(msg_len, LSIState), 2115 VMSTATE_BUFFER(msg, LSIState), 2116 VMSTATE_INT32(waiting, LSIState), 2117 2118 VMSTATE_UINT32(dsa, LSIState), 2119 VMSTATE_UINT32(temp, LSIState), 2120 VMSTATE_UINT32(dnad, LSIState), 2121 VMSTATE_UINT32(dbc, LSIState), 2122 VMSTATE_UINT8(istat0, LSIState), 2123 VMSTATE_UINT8(istat1, LSIState), 2124 VMSTATE_UINT8(dcmd, LSIState), 2125 VMSTATE_UINT8(dstat, LSIState), 2126 VMSTATE_UINT8(dien, LSIState), 2127 VMSTATE_UINT8(sist0, LSIState), 2128 VMSTATE_UINT8(sist1, LSIState), 2129 VMSTATE_UINT8(sien0, LSIState), 2130 VMSTATE_UINT8(sien1, LSIState), 2131 VMSTATE_UINT8(mbox0, LSIState), 2132 VMSTATE_UINT8(mbox1, LSIState), 2133 VMSTATE_UINT8(dfifo, LSIState), 2134 VMSTATE_UINT8(ctest2, LSIState), 2135 VMSTATE_UINT8(ctest3, LSIState), 2136 VMSTATE_UINT8(ctest4, LSIState), 2137 VMSTATE_UINT8(ctest5, LSIState), 2138 VMSTATE_UINT8(ccntl0, LSIState), 2139 VMSTATE_UINT8(ccntl1, LSIState), 2140 VMSTATE_UINT32(dsp, LSIState), 2141 VMSTATE_UINT32(dsps, LSIState), 2142 VMSTATE_UINT8(dmode, LSIState), 2143 VMSTATE_UINT8(dcntl, LSIState), 2144 VMSTATE_UINT8(scntl0, LSIState), 2145 VMSTATE_UINT8(scntl1, LSIState), 2146 VMSTATE_UINT8(scntl2, LSIState), 2147 VMSTATE_UINT8(scntl3, LSIState), 2148 VMSTATE_UINT8(sstat0, LSIState), 2149 VMSTATE_UINT8(sstat1, LSIState), 2150 VMSTATE_UINT8(scid, LSIState), 2151 VMSTATE_UINT8(sxfer, LSIState), 2152 VMSTATE_UINT8(socl, LSIState), 2153 VMSTATE_UINT8(sdid, LSIState), 2154 VMSTATE_UINT8(ssid, LSIState), 2155 VMSTATE_UINT8(sfbr, LSIState), 2156 VMSTATE_UINT8(stest1, LSIState), 2157 VMSTATE_UINT8(stest2, LSIState), 2158 VMSTATE_UINT8(stest3, LSIState), 2159 VMSTATE_UINT8(sidl, LSIState), 2160 VMSTATE_UINT8(stime0, LSIState), 2161 VMSTATE_UINT8(respid0, LSIState), 2162 VMSTATE_UINT8(respid1, LSIState), 2163 VMSTATE_UINT32(mmrs, LSIState), 2164 VMSTATE_UINT32(mmws, LSIState), 2165 VMSTATE_UINT32(sfs, LSIState), 2166 VMSTATE_UINT32(drs, LSIState), 2167 VMSTATE_UINT32(sbms, LSIState), 2168 VMSTATE_UINT32(dbms, LSIState), 2169 VMSTATE_UINT32(dnad64, LSIState), 2170 VMSTATE_UINT32(pmjad1, LSIState), 2171 VMSTATE_UINT32(pmjad2, LSIState), 2172 VMSTATE_UINT32(rbc, LSIState), 2173 VMSTATE_UINT32(ua, LSIState), 2174 VMSTATE_UINT32(ia, LSIState), 2175 VMSTATE_UINT32(sbc, LSIState), 2176 VMSTATE_UINT32(csbc, LSIState), 2177 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)), 2178 VMSTATE_UINT8(sbr, LSIState), 2179 2180 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)), 2181 VMSTATE_END_OF_LIST() 2182 } 2183 }; 2184 2185 static const struct SCSIBusInfo lsi_scsi_info = { 2186 .tcq = true, 2187 .max_target = LSI_MAX_DEVS, 2188 .max_lun = 0, /* LUN support is buggy */ 2189 2190 .transfer_data = lsi_transfer_data, 2191 .complete = lsi_command_complete, 2192 .cancel = lsi_request_cancelled 2193 }; 2194 2195 static void lsi_scsi_realize(PCIDevice *dev, Error **errp) 2196 { 2197 LSIState *s = LSI53C895A(dev); 2198 DeviceState *d = DEVICE(dev); 2199 uint8_t *pci_conf; 2200 2201 pci_conf = dev->config; 2202 2203 /* PCI latency timer = 255 */ 2204 pci_conf[PCI_LATENCY_TIMER] = 0xff; 2205 /* Interrupt pin A */ 2206 pci_conf[PCI_INTERRUPT_PIN] = 0x01; 2207 2208 memory_region_init_io(&s->mmio_io, OBJECT(s), &lsi_mmio_ops, s, 2209 "lsi-mmio", 0x400); 2210 memory_region_init_io(&s->ram_io, OBJECT(s), &lsi_ram_ops, s, 2211 "lsi-ram", 0x2000); 2212 memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s, 2213 "lsi-io", 256); 2214 2215 address_space_init(&s->pci_io_as, pci_address_space_io(dev), "lsi-pci-io"); 2216 2217 pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io); 2218 pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mmio_io); 2219 pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io); 2220 QTAILQ_INIT(&s->queue); 2221 2222 scsi_bus_new(&s->bus, sizeof(s->bus), d, &lsi_scsi_info, NULL); 2223 } 2224 2225 static void lsi_scsi_unrealize(DeviceState *dev, Error **errp) 2226 { 2227 LSIState *s = LSI53C895A(dev); 2228 2229 address_space_destroy(&s->pci_io_as); 2230 } 2231 2232 static void lsi_class_init(ObjectClass *klass, void *data) 2233 { 2234 DeviceClass *dc = DEVICE_CLASS(klass); 2235 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 2236 2237 k->realize = lsi_scsi_realize; 2238 k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC; 2239 k->device_id = PCI_DEVICE_ID_LSI_53C895A; 2240 k->class_id = PCI_CLASS_STORAGE_SCSI; 2241 k->subsystem_id = 0x1000; 2242 dc->unrealize = lsi_scsi_unrealize; 2243 dc->reset = lsi_scsi_reset; 2244 dc->vmsd = &vmstate_lsi_scsi; 2245 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 2246 } 2247 2248 static const TypeInfo lsi_info = { 2249 .name = TYPE_LSI53C895A, 2250 .parent = TYPE_PCI_DEVICE, 2251 .instance_size = sizeof(LSIState), 2252 .class_init = lsi_class_init, 2253 .interfaces = (InterfaceInfo[]) { 2254 { INTERFACE_CONVENTIONAL_PCI_DEVICE }, 2255 { }, 2256 }, 2257 }; 2258 2259 static void lsi53c810_class_init(ObjectClass *klass, void *data) 2260 { 2261 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 2262 2263 k->device_id = PCI_DEVICE_ID_LSI_53C810; 2264 } 2265 2266 static TypeInfo lsi53c810_info = { 2267 .name = TYPE_LSI53C810, 2268 .parent = TYPE_LSI53C895A, 2269 .class_init = lsi53c810_class_init, 2270 }; 2271 2272 static void lsi53c895a_register_types(void) 2273 { 2274 type_register_static(&lsi_info); 2275 type_register_static(&lsi53c810_info); 2276 } 2277 2278 type_init(lsi53c895a_register_types) 2279 2280 void lsi53c895a_create(PCIBus *bus) 2281 { 2282 LSIState *s = LSI53C895A(pci_create_simple(bus, -1, "lsi53c895a")); 2283 2284 scsi_bus_legacy_handle_cmdline(&s->bus); 2285 } 2286 2287 void lsi53c810_create(PCIBus *bus, int devfn) 2288 { 2289 LSIState *s = LSI53C895A(pci_create_simple(bus, devfn, "lsi53c810")); 2290 2291 scsi_bus_legacy_handle_cmdline(&s->bus); 2292 } 2293