?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
qemu-doc: fix typos
[qemu/ar7.git] / hw / scsi / lsi53c895a.c
blobc5b0cc5cafb0b930d706ca6b6941eb0cc1e67b8f
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licensed under the LGPL.
8 */
9
10 /* Note:
11 * LSI53C810 emulation is incorrect, in the sense that it supports
12 * features added in later evolutions. This should not be a problem,
13 * as well-behaved operating systems will not try to use them.
14 */
15
16 #include <assert.h>
17
18 #include "hw/hw.h"
19 #include "hw/pci/pci.h"
20 #include "hw/scsi/scsi.h"
21 #include "sysemu/dma.h"
22
23 //#define DEBUG_LSI
24 //#define DEBUG_LSI_REG
25
26 #ifdef DEBUG_LSI
27 #define DPRINTF(fmt, ...) \
28 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
29 #define BADF(fmt, ...) \
30 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
31 #else
32 #define DPRINTF(fmt, ...) do {} while(0)
33 #define BADF(fmt, ...) \
34 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
35 #endif
36
37 #define LSI_MAX_DEVS 7
38
39 #define LSI_SCNTL0_TRG 0x01
40 #define LSI_SCNTL0_AAP 0x02
41 #define LSI_SCNTL0_EPC 0x08
42 #define LSI_SCNTL0_WATN 0x10
43 #define LSI_SCNTL0_START 0x20
44
45 #define LSI_SCNTL1_SST 0x01
46 #define LSI_SCNTL1_IARB 0x02
47 #define LSI_SCNTL1_AESP 0x04
48 #define LSI_SCNTL1_RST 0x08
49 #define LSI_SCNTL1_CON 0x10
50 #define LSI_SCNTL1_DHP 0x20
51 #define LSI_SCNTL1_ADB 0x40
52 #define LSI_SCNTL1_EXC 0x80
53
54 #define LSI_SCNTL2_WSR 0x01
55 #define LSI_SCNTL2_VUE0 0x02
56 #define LSI_SCNTL2_VUE1 0x04
57 #define LSI_SCNTL2_WSS 0x08
58 #define LSI_SCNTL2_SLPHBEN 0x10
59 #define LSI_SCNTL2_SLPMD 0x20
60 #define LSI_SCNTL2_CHM 0x40
61 #define LSI_SCNTL2_SDU 0x80
62
63 #define LSI_ISTAT0_DIP 0x01
64 #define LSI_ISTAT0_SIP 0x02
65 #define LSI_ISTAT0_INTF 0x04
66 #define LSI_ISTAT0_CON 0x08
67 #define LSI_ISTAT0_SEM 0x10
68 #define LSI_ISTAT0_SIGP 0x20
69 #define LSI_ISTAT0_SRST 0x40
70 #define LSI_ISTAT0_ABRT 0x80
71
72 #define LSI_ISTAT1_SI 0x01
73 #define LSI_ISTAT1_SRUN 0x02
74 #define LSI_ISTAT1_FLSH 0x04
75
76 #define LSI_SSTAT0_SDP0 0x01
77 #define LSI_SSTAT0_RST 0x02
78 #define LSI_SSTAT0_WOA 0x04
79 #define LSI_SSTAT0_LOA 0x08
80 #define LSI_SSTAT0_AIP 0x10
81 #define LSI_SSTAT0_OLF 0x20
82 #define LSI_SSTAT0_ORF 0x40
83 #define LSI_SSTAT0_ILF 0x80
84
85 #define LSI_SIST0_PAR 0x01
86 #define LSI_SIST0_RST 0x02
87 #define LSI_SIST0_UDC 0x04
88 #define LSI_SIST0_SGE 0x08
89 #define LSI_SIST0_RSL 0x10
90 #define LSI_SIST0_SEL 0x20
91 #define LSI_SIST0_CMP 0x40
92 #define LSI_SIST0_MA 0x80
93
94 #define LSI_SIST1_HTH 0x01
95 #define LSI_SIST1_GEN 0x02
96 #define LSI_SIST1_STO 0x04
97 #define LSI_SIST1_SBMC 0x10
98
99 #define LSI_SOCL_IO 0x01
100 #define LSI_SOCL_CD 0x02
101 #define LSI_SOCL_MSG 0x04
102 #define LSI_SOCL_ATN 0x08
103 #define LSI_SOCL_SEL 0x10
104 #define LSI_SOCL_BSY 0x20
105 #define LSI_SOCL_ACK 0x40
106 #define LSI_SOCL_REQ 0x80
107
108 #define LSI_DSTAT_IID 0x01
109 #define LSI_DSTAT_SIR 0x04
110 #define LSI_DSTAT_SSI 0x08
111 #define LSI_DSTAT_ABRT 0x10
112 #define LSI_DSTAT_BF 0x20
113 #define LSI_DSTAT_MDPE 0x40
114 #define LSI_DSTAT_DFE 0x80
115
116 #define LSI_DCNTL_COM 0x01
117 #define LSI_DCNTL_IRQD 0x02
118 #define LSI_DCNTL_STD 0x04
119 #define LSI_DCNTL_IRQM 0x08
120 #define LSI_DCNTL_SSM 0x10
121 #define LSI_DCNTL_PFEN 0x20
122 #define LSI_DCNTL_PFF 0x40
123 #define LSI_DCNTL_CLSE 0x80
124
125 #define LSI_DMODE_MAN 0x01
126 #define LSI_DMODE_BOF 0x02
127 #define LSI_DMODE_ERMP 0x04
128 #define LSI_DMODE_ERL 0x08
129 #define LSI_DMODE_DIOM 0x10
130 #define LSI_DMODE_SIOM 0x20
131
132 #define LSI_CTEST2_DACK 0x01
133 #define LSI_CTEST2_DREQ 0x02
134 #define LSI_CTEST2_TEOP 0x04
135 #define LSI_CTEST2_PCICIE 0x08
136 #define LSI_CTEST2_CM 0x10
137 #define LSI_CTEST2_CIO 0x20
138 #define LSI_CTEST2_SIGP 0x40
139 #define LSI_CTEST2_DDIR 0x80
140
141 #define LSI_CTEST5_BL2 0x04
142 #define LSI_CTEST5_DDIR 0x08
143 #define LSI_CTEST5_MASR 0x10
144 #define LSI_CTEST5_DFSN 0x20
145 #define LSI_CTEST5_BBCK 0x40
146 #define LSI_CTEST5_ADCK 0x80
147
148 #define LSI_CCNTL0_DILS 0x01
149 #define LSI_CCNTL0_DISFC 0x10
150 #define LSI_CCNTL0_ENNDJ 0x20
151 #define LSI_CCNTL0_PMJCTL 0x40
152 #define LSI_CCNTL0_ENPMJ 0x80
153
154 #define LSI_CCNTL1_EN64DBMV 0x01
155 #define LSI_CCNTL1_EN64TIBMV 0x02
156 #define LSI_CCNTL1_64TIMOD 0x04
157 #define LSI_CCNTL1_DDAC 0x08
158 #define LSI_CCNTL1_ZMOD 0x80
159
160 /* Enable Response to Reselection */
161 #define LSI_SCID_RRE 0x60
162
163 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
164
165 #define PHASE_DO 0
166 #define PHASE_DI 1
167 #define PHASE_CMD 2
168 #define PHASE_ST 3
169 #define PHASE_MO 6
170 #define PHASE_MI 7
171 #define PHASE_MASK 7
172
173 /* Maximum length of MSG IN data. */
174 #define LSI_MAX_MSGIN_LEN 8
175
176 /* Flag set if this is a tagged command. */
177 #define LSI_TAG_VALID (1 << 16)
178
179 typedef struct lsi_request {
180 SCSIRequest *req;
181 uint32_t tag;
182 uint32_t dma_len;
183 uint8_t *dma_buf;
184 uint32_t pending;
185 int out;
186 QTAILQ_ENTRY(lsi_request) next;
187 } lsi_request;
188
189 typedef struct {
190 /*< private >*/
191 PCIDevice parent_obj;
192 /*< public >*/
193
194 MemoryRegion mmio_io;
195 MemoryRegion ram_io;
196 MemoryRegion io_io;
197
198 int carry; /* ??? Should this be an a visible register somewhere? */
199 int status;
200 /* Action to take at the end of a MSG IN phase.
201 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
202 int msg_action;
203 int msg_len;
204 uint8_t msg[LSI_MAX_MSGIN_LEN];
205 /* 0 if SCRIPTS are running or stopped.
206 * 1 if a Wait Reselect instruction has been issued.
207 * 2 if processing DMA from lsi_execute_script.
208 * 3 if a DMA operation is in progress. */
209 int waiting;
210 SCSIBus bus;
211 int current_lun;
212 /* The tag is a combination of the device ID and the SCSI tag. */
213 uint32_t select_tag;
214 int command_complete;
215 QTAILQ_HEAD(, lsi_request) queue;
216 lsi_request *current;
217
218 uint32_t dsa;
219 uint32_t temp;
220 uint32_t dnad;
221 uint32_t dbc;
222 uint8_t istat0;
223 uint8_t istat1;
224 uint8_t dcmd;
225 uint8_t dstat;
226 uint8_t dien;
227 uint8_t sist0;
228 uint8_t sist1;
229 uint8_t sien0;
230 uint8_t sien1;
231 uint8_t mbox0;
232 uint8_t mbox1;
233 uint8_t dfifo;
234 uint8_t ctest2;
235 uint8_t ctest3;
236 uint8_t ctest4;
237 uint8_t ctest5;
238 uint8_t ccntl0;
239 uint8_t ccntl1;
240 uint32_t dsp;
241 uint32_t dsps;
242 uint8_t dmode;
243 uint8_t dcntl;
244 uint8_t scntl0;
245 uint8_t scntl1;
246 uint8_t scntl2;
247 uint8_t scntl3;
248 uint8_t sstat0;
249 uint8_t sstat1;
250 uint8_t scid;
251 uint8_t sxfer;
252 uint8_t socl;
253 uint8_t sdid;
254 uint8_t ssid;
255 uint8_t sfbr;
256 uint8_t stest1;
257 uint8_t stest2;
258 uint8_t stest3;
259 uint8_t sidl;
260 uint8_t stime0;
261 uint8_t respid0;
262 uint8_t respid1;
263 uint32_t mmrs;
264 uint32_t mmws;
265 uint32_t sfs;
266 uint32_t drs;
267 uint32_t sbms;
268 uint32_t dbms;
269 uint32_t dnad64;
270 uint32_t pmjad1;
271 uint32_t pmjad2;
272 uint32_t rbc;
273 uint32_t ua;
274 uint32_t ia;
275 uint32_t sbc;
276 uint32_t csbc;
277 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
278 uint8_t sbr;
279 uint32_t adder;
280
281 /* Script ram is stored as 32-bit words in host byteorder. */
282 uint32_t script_ram[2048];
283 } LSIState;
284
285 #define TYPE_LSI53C810 "lsi53c810"
286 #define TYPE_LSI53C895A "lsi53c895a"
287
288 #define LSI53C895A(obj) \
289 OBJECT_CHECK(LSIState, (obj), TYPE_LSI53C895A)
290
291 static inline int lsi_irq_on_rsl(LSIState *s)
292 {
293 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
294 }
295
296 static void lsi_soft_reset(LSIState *s)
297 {
298 DPRINTF("Reset\n");
299 s->carry = 0;
300
301 s->msg_action = 0;
302 s->msg_len = 0;
303 s->waiting = 0;
304 s->dsa = 0;
305 s->dnad = 0;
306 s->dbc = 0;
307 s->temp = 0;
308 memset(s->scratch, 0, sizeof(s->scratch));
309 s->istat0 = 0;
310 s->istat1 = 0;
311 s->dcmd = 0x40;
312 s->dstat = LSI_DSTAT_DFE;
313 s->dien = 0;
314 s->sist0 = 0;
315 s->sist1 = 0;
316 s->sien0 = 0;
317 s->sien1 = 0;
318 s->mbox0 = 0;
319 s->mbox1 = 0;
320 s->dfifo = 0;
321 s->ctest2 = LSI_CTEST2_DACK;
322 s->ctest3 = 0;
323 s->ctest4 = 0;
324 s->ctest5 = 0;
325 s->ccntl0 = 0;
326 s->ccntl1 = 0;
327 s->dsp = 0;
328 s->dsps = 0;
329 s->dmode = 0;
330 s->dcntl = 0;
331 s->scntl0 = 0xc0;
332 s->scntl1 = 0;
333 s->scntl2 = 0;
334 s->scntl3 = 0;
335 s->sstat0 = 0;
336 s->sstat1 = 0;
337 s->scid = 7;
338 s->sxfer = 0;
339 s->socl = 0;
340 s->sdid = 0;
341 s->ssid = 0;
342 s->stest1 = 0;
343 s->stest2 = 0;
344 s->stest3 = 0;
345 s->sidl = 0;
346 s->stime0 = 0;
347 s->respid0 = 0x80;
348 s->respid1 = 0;
349 s->mmrs = 0;
350 s->mmws = 0;
351 s->sfs = 0;
352 s->drs = 0;
353 s->sbms = 0;
354 s->dbms = 0;
355 s->dnad64 = 0;
356 s->pmjad1 = 0;
357 s->pmjad2 = 0;
358 s->rbc = 0;
359 s->ua = 0;
360 s->ia = 0;
361 s->sbc = 0;
362 s->csbc = 0;
363 s->sbr = 0;
364 assert(QTAILQ_EMPTY(&s->queue));
365 assert(!s->current);
366 }
367
368 static int lsi_dma_40bit(LSIState *s)
369 {
370 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
371 return 1;
372 return 0;
373 }
374
375 static int lsi_dma_ti64bit(LSIState *s)
376 {
377 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
378 return 1;
379 return 0;
380 }
381
382 static int lsi_dma_64bit(LSIState *s)
383 {
384 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
385 return 1;
386 return 0;
387 }
388
389 static uint8_t lsi_reg_readb(LSIState *s, int offset);
390 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
391 static void lsi_execute_script(LSIState *s);
392 static void lsi_reselect(LSIState *s, lsi_request *p);
393
394 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
395 {
396 uint32_t buf;
397
398 pci_dma_read(PCI_DEVICE(s), addr, &buf, 4);
399 return cpu_to_le32(buf);
400 }
401
402 static void lsi_stop_script(LSIState *s)
403 {
404 s->istat1 &= ~LSI_ISTAT1_SRUN;
405 }
406
407 static void lsi_update_irq(LSIState *s)
408 {
409 PCIDevice *d = PCI_DEVICE(s);
410 int level;
411 static int last_level;
412 lsi_request *p;
413
414 /* It's unclear whether the DIP/SIP bits should be cleared when the
415 Interrupt Status Registers are cleared or when istat0 is read.
416 We currently do the formwer, which seems to work. */
417 level = 0;
418 if (s->dstat) {
419 if (s->dstat & s->dien)
420 level = 1;
421 s->istat0 |= LSI_ISTAT0_DIP;
422 } else {
423 s->istat0 &= ~LSI_ISTAT0_DIP;
424 }
425
426 if (s->sist0 || s->sist1) {
427 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
428 level = 1;
429 s->istat0 |= LSI_ISTAT0_SIP;
430 } else {
431 s->istat0 &= ~LSI_ISTAT0_SIP;
432 }
433 if (s->istat0 & LSI_ISTAT0_INTF)
434 level = 1;
435
436 if (level != last_level) {
437 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
438 level, s->dstat, s->sist1, s->sist0);
439 last_level = level;
440 }
441 pci_set_irq(d, level);
442
443 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
444 DPRINTF("Handled IRQs & disconnected, looking for pending "
445 "processes\n");
446 QTAILQ_FOREACH(p, &s->queue, next) {
447 if (p->pending) {
448 lsi_reselect(s, p);
449 break;
450 }
451 }
452 }
453 }
454
455 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
456 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
457 {
458 uint32_t mask0;
459 uint32_t mask1;
460
461 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
462 stat1, stat0, s->sist1, s->sist0);
463 s->sist0 |= stat0;
464 s->sist1 |= stat1;
465 /* Stop processor on fatal or unmasked interrupt. As a special hack
466 we don't stop processing when raising STO. Instead continue
467 execution and stop at the next insn that accesses the SCSI bus. */
468 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
469 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
470 mask1 &= ~LSI_SIST1_STO;
471 if (s->sist0 & mask0 || s->sist1 & mask1) {
472 lsi_stop_script(s);
473 }
474 lsi_update_irq(s);
475 }
476
477 /* Stop SCRIPTS execution and raise a DMA interrupt. */
478 static void lsi_script_dma_interrupt(LSIState *s, int stat)
479 {
480 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
481 s->dstat |= stat;
482 lsi_update_irq(s);
483 lsi_stop_script(s);
484 }
485
486 static inline void lsi_set_phase(LSIState *s, int phase)
487 {
488 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
489 }
490
491 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
492 {
493 /* Trigger a phase mismatch. */
494 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
495 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
496 s->dsp = out ? s->pmjad1 : s->pmjad2;
497 } else {
498 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
499 }
500 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
501 } else {
502 DPRINTF("Phase mismatch interrupt\n");
503 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
504 lsi_stop_script(s);
505 }
506 lsi_set_phase(s, new_phase);
507 }
508
509
510 /* Resume SCRIPTS execution after a DMA operation. */
511 static void lsi_resume_script(LSIState *s)
512 {
513 if (s->waiting != 2) {
514 s->waiting = 0;
515 lsi_execute_script(s);
516 } else {
517 s->waiting = 0;
518 }
519 }
520
521 static void lsi_disconnect(LSIState *s)
522 {
523 s->scntl1 &= ~LSI_SCNTL1_CON;
524 s->sstat1 &= ~PHASE_MASK;
525 }
526
527 static void lsi_bad_selection(LSIState *s, uint32_t id)
528 {
529 DPRINTF("Selected absent target %d\n", id);
530 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
531 lsi_disconnect(s);
532 }
533
534 /* Initiate a SCSI layer data transfer. */
535 static void lsi_do_dma(LSIState *s, int out)
536 {
537 PCIDevice *pci_dev;
538 uint32_t count;
539 dma_addr_t addr;
540 SCSIDevice *dev;
541
542 assert(s->current);
543 if (!s->current->dma_len) {
544 /* Wait until data is available. */
545 DPRINTF("DMA no data available\n");
546 return;
547 }
548
549 pci_dev = PCI_DEVICE(s);
550 dev = s->current->req->dev;
551 assert(dev);
552
553 count = s->dbc;
554 if (count > s->current->dma_len)
555 count = s->current->dma_len;
556
557 addr = s->dnad;
558 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
559 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
560 addr |= ((uint64_t)s->dnad64 << 32);
561 else if (s->dbms)
562 addr |= ((uint64_t)s->dbms << 32);
563 else if (s->sbms)
564 addr |= ((uint64_t)s->sbms << 32);
565
566 DPRINTF("DMA addr=0x" DMA_ADDR_FMT " len=%d\n", addr, count);
567 s->csbc += count;
568 s->dnad += count;
569 s->dbc -= count;
570 if (s->current->dma_buf == NULL) {
571 s->current->dma_buf = scsi_req_get_buf(s->current->req);
572 }
573 /* ??? Set SFBR to first data byte. */
574 if (out) {
575 pci_dma_read(pci_dev, addr, s->current->dma_buf, count);
576 } else {
577 pci_dma_write(pci_dev, addr, s->current->dma_buf, count);
578 }
579 s->current->dma_len -= count;
580 if (s->current->dma_len == 0) {
581 s->current->dma_buf = NULL;
582 scsi_req_continue(s->current->req);
583 } else {
584 s->current->dma_buf += count;
585 lsi_resume_script(s);
586 }
587 }
588
589
590 /* Add a command to the queue. */
591 static void lsi_queue_command(LSIState *s)
592 {
593 lsi_request *p = s->current;
594
595 DPRINTF("Queueing tag=0x%x\n", p->tag);
596 assert(s->current != NULL);
597 assert(s->current->dma_len == 0);
598 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
599 s->current = NULL;
600
601 p->pending = 0;
602 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
603 }
604
605 /* Queue a byte for a MSG IN phase. */
606 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
607 {
608 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
609 BADF("MSG IN data too long\n");
610 } else {
611 DPRINTF("MSG IN 0x%02x\n", data);
612 s->msg[s->msg_len++] = data;
613 }
614 }
615
616 /* Perform reselection to continue a command. */
617 static void lsi_reselect(LSIState *s, lsi_request *p)
618 {
619 int id;
620
621 assert(s->current == NULL);
622 QTAILQ_REMOVE(&s->queue, p, next);
623 s->current = p;
624
625 id = (p->tag >> 8) & 0xf;
626 s->ssid = id | 0x80;
627 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
628 if (!(s->dcntl & LSI_DCNTL_COM)) {
629 s->sfbr = 1 << (id & 0x7);
630 }
631 DPRINTF("Reselected target %d\n", id);
632 s->scntl1 |= LSI_SCNTL1_CON;
633 lsi_set_phase(s, PHASE_MI);
634 s->msg_action = p->out ? 2 : 3;
635 s->current->dma_len = p->pending;
636 lsi_add_msg_byte(s, 0x80);
637 if (s->current->tag & LSI_TAG_VALID) {
638 lsi_add_msg_byte(s, 0x20);
639 lsi_add_msg_byte(s, p->tag & 0xff);
640 }
641
642 if (lsi_irq_on_rsl(s)) {
643 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
644 }
645 }
646
647 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
648 {
649 lsi_request *p;
650
651 QTAILQ_FOREACH(p, &s->queue, next) {
652 if (p->tag == tag) {
653 return p;
654 }
655 }
656
657 return NULL;
658 }
659
660 static void lsi_request_free(LSIState *s, lsi_request *p)
661 {
662 if (p == s->current) {
663 s->current = NULL;
664 } else {
665 QTAILQ_REMOVE(&s->queue, p, next);
666 }
667 g_free(p);
668 }
669
670 static void lsi_request_cancelled(SCSIRequest *req)
671 {
672 LSIState *s = LSI53C895A(req->bus->qbus.parent);
673 lsi_request *p = req->hba_private;
674
675 req->hba_private = NULL;
676 lsi_request_free(s, p);
677 scsi_req_unref(req);
678 }
679
680 /* Record that data is available for a queued command. Returns zero if
681 the device was reselected, nonzero if the IO is deferred. */
682 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
683 {
684 lsi_request *p = req->hba_private;
685
686 if (p->pending) {
687 BADF("Multiple IO pending for request %p\n", p);
688 }
689 p->pending = len;
690 /* Reselect if waiting for it, or if reselection triggers an IRQ
691 and the bus is free.
692 Since no interrupt stacking is implemented in the emulation, it
693 is also required that there are no pending interrupts waiting
694 for service from the device driver. */
695 if (s->waiting == 1 ||
696 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
697 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
698 /* Reselect device. */
699 lsi_reselect(s, p);
700 return 0;
701 } else {
702 DPRINTF("Queueing IO tag=0x%x\n", p->tag);
703 p->pending = len;
704 return 1;
705 }
706 }
707
708 /* Callback to indicate that the SCSI layer has completed a command. */
709 static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
710 {
711 LSIState *s = LSI53C895A(req->bus->qbus.parent);
712 int out;
713
714 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
715 DPRINTF("Command complete status=%d\n", (int)status);
716 s->status = status;
717 s->command_complete = 2;
718 if (s->waiting && s->dbc != 0) {
719 /* Raise phase mismatch for short transfers. */
720 lsi_bad_phase(s, out, PHASE_ST);
721 } else {
722 lsi_set_phase(s, PHASE_ST);
723 }
724
725 if (req->hba_private == s->current) {
726 req->hba_private = NULL;
727 lsi_request_free(s, s->current);
728 scsi_req_unref(req);
729 }
730 lsi_resume_script(s);
731 }
732
733 /* Callback to indicate that the SCSI layer has completed a transfer. */
734 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
735 {
736 LSIState *s = LSI53C895A(req->bus->qbus.parent);
737 int out;
738
739 assert(req->hba_private);
740 if (s->waiting == 1 || req->hba_private != s->current ||
741 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
742 if (lsi_queue_req(s, req, len)) {
743 return;
744 }
745 }
746
747 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
748
749 /* host adapter (re)connected */
750 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
751 s->current->dma_len = len;
752 s->command_complete = 1;
753 if (s->waiting) {
754 if (s->waiting == 1 || s->dbc == 0) {
755 lsi_resume_script(s);
756 } else {
757 lsi_do_dma(s, out);
758 }
759 }
760 }
761
762 static void lsi_do_command(LSIState *s)
763 {
764 SCSIDevice *dev;
765 uint8_t buf[16];
766 uint32_t id;
767 int n;
768
769 DPRINTF("Send command len=%d\n", s->dbc);
770 if (s->dbc > 16)
771 s->dbc = 16;
772 pci_dma_read(PCI_DEVICE(s), s->dnad, buf, s->dbc);
773 s->sfbr = buf[0];
774 s->command_complete = 0;
775
776 id = (s->select_tag >> 8) & 0xf;
777 dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
778 if (!dev) {
779 lsi_bad_selection(s, id);
780 return;
781 }
782
783 assert(s->current == NULL);
784 s->current = g_new0(lsi_request, 1);
785 s->current->tag = s->select_tag;
786 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
787 s->current);
788
789 n = scsi_req_enqueue(s->current->req);
790 if (n) {
791 if (n > 0) {
792 lsi_set_phase(s, PHASE_DI);
793 } else if (n < 0) {
794 lsi_set_phase(s, PHASE_DO);
795 }
796 scsi_req_continue(s->current->req);
797 }
798 if (!s->command_complete) {
799 if (n) {
800 /* Command did not complete immediately so disconnect. */
801 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
802 lsi_add_msg_byte(s, 4); /* DISCONNECT */
803 /* wait data */
804 lsi_set_phase(s, PHASE_MI);
805 s->msg_action = 1;
806 lsi_queue_command(s);
807 } else {
808 /* wait command complete */
809 lsi_set_phase(s, PHASE_DI);
810 }
811 }
812 }
813
814 static void lsi_do_status(LSIState *s)
815 {
816 uint8_t status;
817 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
818 if (s->dbc != 1)
819 BADF("Bad Status move\n");
820 s->dbc = 1;
821 status = s->status;
822 s->sfbr = status;
823 pci_dma_write(PCI_DEVICE(s), s->dnad, &status, 1);
824 lsi_set_phase(s, PHASE_MI);
825 s->msg_action = 1;
826 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
827 }
828
829 static void lsi_do_msgin(LSIState *s)
830 {
831 int len;
832 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
833 s->sfbr = s->msg[0];
834 len = s->msg_len;
835 if (len > s->dbc)
836 len = s->dbc;
837 pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
838 /* Linux drivers rely on the last byte being in the SIDL. */
839 s->sidl = s->msg[len - 1];
840 s->msg_len -= len;
841 if (s->msg_len) {
842 memmove(s->msg, s->msg + len, s->msg_len);
843 } else {
844 /* ??? Check if ATN (not yet implemented) is asserted and maybe
845 switch to PHASE_MO. */
846 switch (s->msg_action) {
847 case 0:
848 lsi_set_phase(s, PHASE_CMD);
849 break;
850 case 1:
851 lsi_disconnect(s);
852 break;
853 case 2:
854 lsi_set_phase(s, PHASE_DO);
855 break;
856 case 3:
857 lsi_set_phase(s, PHASE_DI);
858 break;
859 default:
860 abort();
861 }
862 }
863 }
864
865 /* Read the next byte during a MSGOUT phase. */
866 static uint8_t lsi_get_msgbyte(LSIState *s)
867 {
868 uint8_t data;
869 pci_dma_read(PCI_DEVICE(s), s->dnad, &data, 1);
870 s->dnad++;
871 s->dbc--;
872 return data;
873 }
874
875 /* Skip the next n bytes during a MSGOUT phase. */
876 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
877 {
878 s->dnad += n;
879 s->dbc -= n;
880 }
881
882 static void lsi_do_msgout(LSIState *s)
883 {
884 uint8_t msg;
885 int len;
886 uint32_t current_tag;
887 lsi_request *current_req, *p, *p_next;
888
889 if (s->current) {
890 current_tag = s->current->tag;
891 current_req = s->current;
892 } else {
893 current_tag = s->select_tag;
894 current_req = lsi_find_by_tag(s, current_tag);
895 }
896
897 DPRINTF("MSG out len=%d\n", s->dbc);
898 while (s->dbc) {
899 msg = lsi_get_msgbyte(s);
900 s->sfbr = msg;
901
902 switch (msg) {
903 case 0x04:
904 DPRINTF("MSG: Disconnect\n");
905 lsi_disconnect(s);
906 break;
907 case 0x08:
908 DPRINTF("MSG: No Operation\n");
909 lsi_set_phase(s, PHASE_CMD);
910 break;
911 case 0x01:
912 len = lsi_get_msgbyte(s);
913 msg = lsi_get_msgbyte(s);
914 (void)len; /* avoid a warning about unused variable*/
915 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
916 switch (msg) {
917 case 1:
918 DPRINTF("SDTR (ignored)\n");
919 lsi_skip_msgbytes(s, 2);
920 break;
921 case 3:
922 DPRINTF("WDTR (ignored)\n");
923 lsi_skip_msgbytes(s, 1);
924 break;
925 default:
926 goto bad;
927 }
928 break;
929 case 0x20: /* SIMPLE queue */
930 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
931 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
932 break;
933 case 0x21: /* HEAD of queue */
934 BADF("HEAD queue not implemented\n");
935 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
936 break;
937 case 0x22: /* ORDERED queue */
938 BADF("ORDERED queue not implemented\n");
939 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
940 break;
941 case 0x0d:
942 /* The ABORT TAG message clears the current I/O process only. */
943 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
944 if (current_req) {
945 scsi_req_cancel(current_req->req);
946 }
947 lsi_disconnect(s);
948 break;
949 case 0x06:
950 case 0x0e:
951 case 0x0c:
952 /* The ABORT message clears all I/O processes for the selecting
953 initiator on the specified logical unit of the target. */
954 if (msg == 0x06) {
955 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
956 }
957 /* The CLEAR QUEUE message clears all I/O processes for all
958 initiators on the specified logical unit of the target. */
959 if (msg == 0x0e) {
960 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
961 }
962 /* The BUS DEVICE RESET message clears all I/O processes for all
963 initiators on all logical units of the target. */
964 if (msg == 0x0c) {
965 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
966 }
967
968 /* clear the current I/O process */
969 if (s->current) {
970 scsi_req_cancel(s->current->req);
971 }
972
973 /* As the current implemented devices scsi_disk and scsi_generic
974 only support one LUN, we don't need to keep track of LUNs.
975 Clearing I/O processes for other initiators could be possible
976 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
977 device, but this is currently not implemented (and seems not
978 to be really necessary). So let's simply clear all queued
979 commands for the current device: */
980 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
981 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
982 scsi_req_cancel(p->req);
983 }
984 }
985
986 lsi_disconnect(s);
987 break;
988 default:
989 if ((msg & 0x80) == 0) {
990 goto bad;
991 }
992 s->current_lun = msg & 7;
993 DPRINTF("Select LUN %d\n", s->current_lun);
994 lsi_set_phase(s, PHASE_CMD);
995 break;
996 }
997 }
998 return;
999 bad:
1000 BADF("Unimplemented message 0x%02x\n", msg);
1001 lsi_set_phase(s, PHASE_MI);
1002 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
1003 s->msg_action = 0;
1004 }
1005
1006 #define LSI_BUF_SIZE 4096
1007 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1008 {
1009 PCIDevice *d = PCI_DEVICE(s);
1010 int n;
1011 uint8_t buf[LSI_BUF_SIZE];
1012
1013 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1014 while (count) {
1015 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1016 pci_dma_read(d, src, buf, n);
1017 pci_dma_write(d, dest, buf, n);
1018 src += n;
1019 dest += n;
1020 count -= n;
1021 }
1022 }
1023
1024 static void lsi_wait_reselect(LSIState *s)
1025 {
1026 lsi_request *p;
1027
1028 DPRINTF("Wait Reselect\n");
1029
1030 QTAILQ_FOREACH(p, &s->queue, next) {
1031 if (p->pending) {
1032 lsi_reselect(s, p);
1033 break;
1034 }
1035 }
1036 if (s->current == NULL) {
1037 s->waiting = 1;
1038 }
1039 }
1040
1041 static void lsi_execute_script(LSIState *s)
1042 {
1043 PCIDevice *pci_dev = PCI_DEVICE(s);
1044 uint32_t insn;
1045 uint32_t addr, addr_high;
1046 int opcode;
1047 int insn_processed = 0;
1048
1049 s->istat1 |= LSI_ISTAT1_SRUN;
1050 again:
1051 insn_processed++;
1052 insn = read_dword(s, s->dsp);
1053 if (!insn) {
1054 /* If we receive an empty opcode increment the DSP by 4 bytes
1055 instead of 8 and execute the next opcode at that location */
1056 s->dsp += 4;
1057 goto again;
1058 }
1059 addr = read_dword(s, s->dsp + 4);
1060 addr_high = 0;
1061 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1062 s->dsps = addr;
1063 s->dcmd = insn >> 24;
1064 s->dsp += 8;
1065 switch (insn >> 30) {
1066 case 0: /* Block move. */
1067 if (s->sist1 & LSI_SIST1_STO) {
1068 DPRINTF("Delayed select timeout\n");
1069 lsi_stop_script(s);
1070 break;
1071 }
1072 s->dbc = insn & 0xffffff;
1073 s->rbc = s->dbc;
1074 /* ??? Set ESA. */
1075 s->ia = s->dsp - 8;
1076 if (insn & (1 << 29)) {
1077 /* Indirect addressing. */
1078 addr = read_dword(s, addr);
1079 } else if (insn & (1 << 28)) {
1080 uint32_t buf[2];
1081 int32_t offset;
1082 /* Table indirect addressing. */
1083
1084 /* 32-bit Table indirect */
1085 offset = sextract32(addr, 0, 24);
1086 pci_dma_read(pci_dev, s->dsa + offset, buf, 8);
1087 /* byte count is stored in bits 0:23 only */
1088 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1089 s->rbc = s->dbc;
1090 addr = cpu_to_le32(buf[1]);
1091
1092 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1093 * table, bits [31:24] */
1094 if (lsi_dma_40bit(s))
1095 addr_high = cpu_to_le32(buf[0]) >> 24;
1096 else if (lsi_dma_ti64bit(s)) {
1097 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1098 switch (selector) {
1099 case 0 ... 0x0f:
1100 /* offset index into scratch registers since
1101 * TI64 mode can use registers C to R */
1102 addr_high = s->scratch[2 + selector];
1103 break;
1104 case 0x10:
1105 addr_high = s->mmrs;
1106 break;
1107 case 0x11:
1108 addr_high = s->mmws;
1109 break;
1110 case 0x12:
1111 addr_high = s->sfs;
1112 break;
1113 case 0x13:
1114 addr_high = s->drs;
1115 break;
1116 case 0x14:
1117 addr_high = s->sbms;
1118 break;
1119 case 0x15:
1120 addr_high = s->dbms;
1121 break;
1122 default:
1123 BADF("Illegal selector specified (0x%x > 0x15)"
1124 " for 64-bit DMA block move", selector);
1125 break;
1126 }
1127 }
1128 } else if (lsi_dma_64bit(s)) {
1129 /* fetch a 3rd dword if 64-bit direct move is enabled and
1130 only if we're not doing table indirect or indirect addressing */
1131 s->dbms = read_dword(s, s->dsp);
1132 s->dsp += 4;
1133 s->ia = s->dsp - 12;
1134 }
1135 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1136 DPRINTF("Wrong phase got %d expected %d\n",
1137 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1138 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1139 break;
1140 }
1141 s->dnad = addr;
1142 s->dnad64 = addr_high;
1143 switch (s->sstat1 & 0x7) {
1144 case PHASE_DO:
1145 s->waiting = 2;
1146 lsi_do_dma(s, 1);
1147 if (s->waiting)
1148 s->waiting = 3;
1149 break;
1150 case PHASE_DI:
1151 s->waiting = 2;
1152 lsi_do_dma(s, 0);
1153 if (s->waiting)
1154 s->waiting = 3;
1155 break;
1156 case PHASE_CMD:
1157 lsi_do_command(s);
1158 break;
1159 case PHASE_ST:
1160 lsi_do_status(s);
1161 break;
1162 case PHASE_MO:
1163 lsi_do_msgout(s);
1164 break;
1165 case PHASE_MI:
1166 lsi_do_msgin(s);
1167 break;
1168 default:
1169 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1170 exit(1);
1171 }
1172 s->dfifo = s->dbc & 0xff;
1173 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1174 s->sbc = s->dbc;
1175 s->rbc -= s->dbc;
1176 s->ua = addr + s->dbc;
1177 break;
1178
1179 case 1: /* IO or Read/Write instruction. */
1180 opcode = (insn >> 27) & 7;
1181 if (opcode < 5) {
1182 uint32_t id;
1183
1184 if (insn & (1 << 25)) {
1185 id = read_dword(s, s->dsa + sextract32(insn, 0, 24));
1186 } else {
1187 id = insn;
1188 }
1189 id = (id >> 16) & 0xf;
1190 if (insn & (1 << 26)) {
1191 addr = s->dsp + sextract32(addr, 0, 24);
1192 }
1193 s->dnad = addr;
1194 switch (opcode) {
1195 case 0: /* Select */
1196 s->sdid = id;
1197 if (s->scntl1 & LSI_SCNTL1_CON) {
1198 DPRINTF("Already reselected, jumping to alternative address\n");
1199 s->dsp = s->dnad;
1200 break;
1201 }
1202 s->sstat0 |= LSI_SSTAT0_WOA;
1203 s->scntl1 &= ~LSI_SCNTL1_IARB;
1204 if (!scsi_device_find(&s->bus, 0, id, 0)) {
1205 lsi_bad_selection(s, id);
1206 break;
1207 }
1208 DPRINTF("Selected target %d%s\n",
1209 id, insn & (1 << 3) ? " ATN" : "");
1210 /* ??? Linux drivers compain when this is set. Maybe
1211 it only applies in low-level mode (unimplemented).
1212 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1213 s->select_tag = id << 8;
1214 s->scntl1 |= LSI_SCNTL1_CON;
1215 if (insn & (1 << 3)) {
1216 s->socl |= LSI_SOCL_ATN;
1217 }
1218 lsi_set_phase(s, PHASE_MO);
1219 break;
1220 case 1: /* Disconnect */
1221 DPRINTF("Wait Disconnect\n");
1222 s->scntl1 &= ~LSI_SCNTL1_CON;
1223 break;
1224 case 2: /* Wait Reselect */
1225 if (!lsi_irq_on_rsl(s)) {
1226 lsi_wait_reselect(s);
1227 }
1228 break;
1229 case 3: /* Set */
1230 DPRINTF("Set%s%s%s%s\n",
1231 insn & (1 << 3) ? " ATN" : "",
1232 insn & (1 << 6) ? " ACK" : "",
1233 insn & (1 << 9) ? " TM" : "",
1234 insn & (1 << 10) ? " CC" : "");
1235 if (insn & (1 << 3)) {
1236 s->socl |= LSI_SOCL_ATN;
1237 lsi_set_phase(s, PHASE_MO);
1238 }
1239 if (insn & (1 << 9)) {
1240 BADF("Target mode not implemented\n");
1241 exit(1);
1242 }
1243 if (insn & (1 << 10))
1244 s->carry = 1;
1245 break;
1246 case 4: /* Clear */
1247 DPRINTF("Clear%s%s%s%s\n",
1248 insn & (1 << 3) ? " ATN" : "",
1249 insn & (1 << 6) ? " ACK" : "",
1250 insn & (1 << 9) ? " TM" : "",
1251 insn & (1 << 10) ? " CC" : "");
1252 if (insn & (1 << 3)) {
1253 s->socl &= ~LSI_SOCL_ATN;
1254 }
1255 if (insn & (1 << 10))
1256 s->carry = 0;
1257 break;
1258 }
1259 } else {
1260 uint8_t op0;
1261 uint8_t op1;
1262 uint8_t data8;
1263 int reg;
1264 int operator;
1265 #ifdef DEBUG_LSI
1266 static const char *opcode_names[3] =
1267 {"Write", "Read", "Read-Modify-Write"};
1268 static const char *operator_names[8] =
1269 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1270 #endif
1271
1272 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1273 data8 = (insn >> 8) & 0xff;
1274 opcode = (insn >> 27) & 7;
1275 operator = (insn >> 24) & 7;
1276 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1277 opcode_names[opcode - 5], reg,
1278 operator_names[operator], data8, s->sfbr,
1279 (insn & (1 << 23)) ? " SFBR" : "");
1280 op0 = op1 = 0;
1281 switch (opcode) {
1282 case 5: /* From SFBR */
1283 op0 = s->sfbr;
1284 op1 = data8;
1285 break;
1286 case 6: /* To SFBR */
1287 if (operator)
1288 op0 = lsi_reg_readb(s, reg);
1289 op1 = data8;
1290 break;
1291 case 7: /* Read-modify-write */
1292 if (operator)
1293 op0 = lsi_reg_readb(s, reg);
1294 if (insn & (1 << 23)) {
1295 op1 = s->sfbr;
1296 } else {
1297 op1 = data8;
1298 }
1299 break;
1300 }
1301
1302 switch (operator) {
1303 case 0: /* move */
1304 op0 = op1;
1305 break;
1306 case 1: /* Shift left */
1307 op1 = op0 >> 7;
1308 op0 = (op0 << 1) | s->carry;
1309 s->carry = op1;
1310 break;
1311 case 2: /* OR */
1312 op0 |= op1;
1313 break;
1314 case 3: /* XOR */
1315 op0 ^= op1;
1316 break;
1317 case 4: /* AND */
1318 op0 &= op1;
1319 break;
1320 case 5: /* SHR */
1321 op1 = op0 & 1;
1322 op0 = (op0 >> 1) | (s->carry << 7);
1323 s->carry = op1;
1324 break;
1325 case 6: /* ADD */
1326 op0 += op1;
1327 s->carry = op0 < op1;
1328 break;
1329 case 7: /* ADC */
1330 op0 += op1 + s->carry;
1331 if (s->carry)
1332 s->carry = op0 <= op1;
1333 else
1334 s->carry = op0 < op1;
1335 break;
1336 }
1337
1338 switch (opcode) {
1339 case 5: /* From SFBR */
1340 case 7: /* Read-modify-write */
1341 lsi_reg_writeb(s, reg, op0);
1342 break;
1343 case 6: /* To SFBR */
1344 s->sfbr = op0;
1345 break;
1346 }
1347 }
1348 break;
1349
1350 case 2: /* Transfer Control. */
1351 {
1352 int cond;
1353 int jmp;
1354
1355 if ((insn & 0x002e0000) == 0) {
1356 DPRINTF("NOP\n");
1357 break;
1358 }
1359 if (s->sist1 & LSI_SIST1_STO) {
1360 DPRINTF("Delayed select timeout\n");
1361 lsi_stop_script(s);
1362 break;
1363 }
1364 cond = jmp = (insn & (1 << 19)) != 0;
1365 if (cond == jmp && (insn & (1 << 21))) {
1366 DPRINTF("Compare carry %d\n", s->carry == jmp);
1367 cond = s->carry != 0;
1368 }
1369 if (cond == jmp && (insn & (1 << 17))) {
1370 DPRINTF("Compare phase %d %c= %d\n",
1371 (s->sstat1 & PHASE_MASK),
1372 jmp ? '=' : '!',
1373 ((insn >> 24) & 7));
1374 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1375 }
1376 if (cond == jmp && (insn & (1 << 18))) {
1377 uint8_t mask;
1378
1379 mask = (~insn >> 8) & 0xff;
1380 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1381 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1382 cond = (s->sfbr & mask) == (insn & mask);
1383 }
1384 if (cond == jmp) {
1385 if (insn & (1 << 23)) {
1386 /* Relative address. */
1387 addr = s->dsp + sextract32(addr, 0, 24);
1388 }
1389 switch ((insn >> 27) & 7) {
1390 case 0: /* Jump */
1391 DPRINTF("Jump to 0x%08x\n", addr);
1392 s->adder = addr;
1393 s->dsp = addr;
1394 break;
1395 case 1: /* Call */
1396 DPRINTF("Call 0x%08x\n", addr);
1397 s->temp = s->dsp;
1398 s->dsp = addr;
1399 break;
1400 case 2: /* Return */
1401 DPRINTF("Return to 0x%08x\n", s->temp);
1402 s->dsp = s->temp;
1403 break;
1404 case 3: /* Interrupt */
1405 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1406 if ((insn & (1 << 20)) != 0) {
1407 s->istat0 |= LSI_ISTAT0_INTF;
1408 lsi_update_irq(s);
1409 } else {
1410 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1411 }
1412 break;
1413 default:
1414 DPRINTF("Illegal transfer control\n");
1415 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1416 break;
1417 }
1418 } else {
1419 DPRINTF("Control condition failed\n");
1420 }
1421 }
1422 break;
1423
1424 case 3:
1425 if ((insn & (1 << 29)) == 0) {
1426 /* Memory move. */
1427 uint32_t dest;
1428 /* ??? The docs imply the destination address is loaded into
1429 the TEMP register. However the Linux drivers rely on
1430 the value being presrved. */
1431 dest = read_dword(s, s->dsp);
1432 s->dsp += 4;
1433 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1434 } else {
1435 uint8_t data[7];
1436 int reg;
1437 int n;
1438 int i;
1439
1440 if (insn & (1 << 28)) {
1441 addr = s->dsa + sextract32(addr, 0, 24);
1442 }
1443 n = (insn & 7);
1444 reg = (insn >> 16) & 0xff;
1445 if (insn & (1 << 24)) {
1446 pci_dma_read(pci_dev, addr, data, n);
1447 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1448 addr, *(int *)data);
1449 for (i = 0; i < n; i++) {
1450 lsi_reg_writeb(s, reg + i, data[i]);
1451 }
1452 } else {
1453 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1454 for (i = 0; i < n; i++) {
1455 data[i] = lsi_reg_readb(s, reg + i);
1456 }
1457 pci_dma_write(pci_dev, addr, data, n);
1458 }
1459 }
1460 }
1461 if (insn_processed > 10000 && !s->waiting) {
1462 /* Some windows drivers make the device spin waiting for a memory
1463 location to change. If we have been executed a lot of code then
1464 assume this is the case and force an unexpected device disconnect.
1465 This is apparently sufficient to beat the drivers into submission.
1466 */
1467 if (!(s->sien0 & LSI_SIST0_UDC))
1468 fprintf(stderr, "inf. loop with UDC masked\n");
1469 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1470 lsi_disconnect(s);
1471 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1472 if (s->dcntl & LSI_DCNTL_SSM) {
1473 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1474 } else {
1475 goto again;
1476 }
1477 }
1478 DPRINTF("SCRIPTS execution stopped\n");
1479 }
1480
1481 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1482 {
1483 uint8_t tmp;
1484 #define CASE_GET_REG24(name, addr) \
1485 case addr: return s->name & 0xff; \
1486 case addr + 1: return (s->name >> 8) & 0xff; \
1487 case addr + 2: return (s->name >> 16) & 0xff;
1488
1489 #define CASE_GET_REG32(name, addr) \
1490 case addr: return s->name & 0xff; \
1491 case addr + 1: return (s->name >> 8) & 0xff; \
1492 case addr + 2: return (s->name >> 16) & 0xff; \
1493 case addr + 3: return (s->name >> 24) & 0xff;
1494
1495 #ifdef DEBUG_LSI_REG
1496 DPRINTF("Read reg %x\n", offset);
1497 #endif
1498 switch (offset) {
1499 case 0x00: /* SCNTL0 */
1500 return s->scntl0;
1501 case 0x01: /* SCNTL1 */
1502 return s->scntl1;
1503 case 0x02: /* SCNTL2 */
1504 return s->scntl2;
1505 case 0x03: /* SCNTL3 */
1506 return s->scntl3;
1507 case 0x04: /* SCID */
1508 return s->scid;
1509 case 0x05: /* SXFER */
1510 return s->sxfer;
1511 case 0x06: /* SDID */
1512 return s->sdid;
1513 case 0x07: /* GPREG0 */
1514 return 0x7f;
1515 case 0x08: /* Revision ID */
1516 return 0x00;
1517 case 0x09: /* SOCL */
1518 return s->socl;
1519 case 0xa: /* SSID */
1520 return s->ssid;
1521 case 0xb: /* SBCL */
1522 /* ??? This is not correct. However it's (hopefully) only
1523 used for diagnostics, so should be ok. */
1524 return 0;
1525 case 0xc: /* DSTAT */
1526 tmp = s->dstat | LSI_DSTAT_DFE;
1527 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1528 s->dstat = 0;
1529 lsi_update_irq(s);
1530 return tmp;
1531 case 0x0d: /* SSTAT0 */
1532 return s->sstat0;
1533 case 0x0e: /* SSTAT1 */
1534 return s->sstat1;
1535 case 0x0f: /* SSTAT2 */
1536 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1537 CASE_GET_REG32(dsa, 0x10)
1538 case 0x14: /* ISTAT0 */
1539 return s->istat0;
1540 case 0x15: /* ISTAT1 */
1541 return s->istat1;
1542 case 0x16: /* MBOX0 */
1543 return s->mbox0;
1544 case 0x17: /* MBOX1 */
1545 return s->mbox1;
1546 case 0x18: /* CTEST0 */
1547 return 0xff;
1548 case 0x19: /* CTEST1 */
1549 return 0;
1550 case 0x1a: /* CTEST2 */
1551 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1552 if (s->istat0 & LSI_ISTAT0_SIGP) {
1553 s->istat0 &= ~LSI_ISTAT0_SIGP;
1554 tmp |= LSI_CTEST2_SIGP;
1555 }
1556 return tmp;
1557 case 0x1b: /* CTEST3 */
1558 return s->ctest3;
1559 CASE_GET_REG32(temp, 0x1c)
1560 case 0x20: /* DFIFO */
1561 return 0;
1562 case 0x21: /* CTEST4 */
1563 return s->ctest4;
1564 case 0x22: /* CTEST5 */
1565 return s->ctest5;
1566 case 0x23: /* CTEST6 */
1567 return 0;
1568 CASE_GET_REG24(dbc, 0x24)
1569 case 0x27: /* DCMD */
1570 return s->dcmd;
1571 CASE_GET_REG32(dnad, 0x28)
1572 CASE_GET_REG32(dsp, 0x2c)
1573 CASE_GET_REG32(dsps, 0x30)
1574 CASE_GET_REG32(scratch[0], 0x34)
1575 case 0x38: /* DMODE */
1576 return s->dmode;
1577 case 0x39: /* DIEN */
1578 return s->dien;
1579 case 0x3a: /* SBR */
1580 return s->sbr;
1581 case 0x3b: /* DCNTL */
1582 return s->dcntl;
1583 /* ADDER Output (Debug of relative jump address) */
1584 CASE_GET_REG32(adder, 0x3c)
1585 case 0x40: /* SIEN0 */
1586 return s->sien0;
1587 case 0x41: /* SIEN1 */
1588 return s->sien1;
1589 case 0x42: /* SIST0 */
1590 tmp = s->sist0;
1591 s->sist0 = 0;
1592 lsi_update_irq(s);
1593 return tmp;
1594 case 0x43: /* SIST1 */
1595 tmp = s->sist1;
1596 s->sist1 = 0;
1597 lsi_update_irq(s);
1598 return tmp;
1599 case 0x46: /* MACNTL */
1600 return 0x0f;
1601 case 0x47: /* GPCNTL0 */
1602 return 0x0f;
1603 case 0x48: /* STIME0 */
1604 return s->stime0;
1605 case 0x4a: /* RESPID0 */
1606 return s->respid0;
1607 case 0x4b: /* RESPID1 */
1608 return s->respid1;
1609 case 0x4d: /* STEST1 */
1610 return s->stest1;
1611 case 0x4e: /* STEST2 */
1612 return s->stest2;
1613 case 0x4f: /* STEST3 */
1614 return s->stest3;
1615 case 0x50: /* SIDL */
1616 /* This is needed by the linux drivers. We currently only update it
1617 during the MSG IN phase. */
1618 return s->sidl;
1619 case 0x52: /* STEST4 */
1620 return 0xe0;
1621 case 0x56: /* CCNTL0 */
1622 return s->ccntl0;
1623 case 0x57: /* CCNTL1 */
1624 return s->ccntl1;
1625 case 0x58: /* SBDL */
1626 /* Some drivers peek at the data bus during the MSG IN phase. */
1627 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1628 return s->msg[0];
1629 return 0;
1630 case 0x59: /* SBDL high */
1631 return 0;
1632 CASE_GET_REG32(mmrs, 0xa0)
1633 CASE_GET_REG32(mmws, 0xa4)
1634 CASE_GET_REG32(sfs, 0xa8)
1635 CASE_GET_REG32(drs, 0xac)
1636 CASE_GET_REG32(sbms, 0xb0)
1637 CASE_GET_REG32(dbms, 0xb4)
1638 CASE_GET_REG32(dnad64, 0xb8)
1639 CASE_GET_REG32(pmjad1, 0xc0)
1640 CASE_GET_REG32(pmjad2, 0xc4)
1641 CASE_GET_REG32(rbc, 0xc8)
1642 CASE_GET_REG32(ua, 0xcc)
1643 CASE_GET_REG32(ia, 0xd4)
1644 CASE_GET_REG32(sbc, 0xd8)
1645 CASE_GET_REG32(csbc, 0xdc)
1646 }
1647 if (offset >= 0x5c && offset < 0xa0) {
1648 int n;
1649 int shift;
1650 n = (offset - 0x58) >> 2;
1651 shift = (offset & 3) * 8;
1652 return (s->scratch[n] >> shift) & 0xff;
1653 }
1654 BADF("readb 0x%x\n", offset);
1655 exit(1);
1656 #undef CASE_GET_REG24
1657 #undef CASE_GET_REG32
1658 }
1659
1660 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1661 {
1662 #define CASE_SET_REG24(name, addr) \
1663 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1664 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1665 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1666
1667 #define CASE_SET_REG32(name, addr) \
1668 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1669 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1670 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1671 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1672
1673 #ifdef DEBUG_LSI_REG
1674 DPRINTF("Write reg %x = %02x\n", offset, val);
1675 #endif
1676 switch (offset) {
1677 case 0x00: /* SCNTL0 */
1678 s->scntl0 = val;
1679 if (val & LSI_SCNTL0_START) {
1680 BADF("Start sequence not implemented\n");
1681 }
1682 break;
1683 case 0x01: /* SCNTL1 */
1684 s->scntl1 = val & ~LSI_SCNTL1_SST;
1685 if (val & LSI_SCNTL1_IARB) {
1686 BADF("Immediate Arbritration not implemented\n");
1687 }
1688 if (val & LSI_SCNTL1_RST) {
1689 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1690 qbus_reset_all(&s->bus.qbus);
1691 s->sstat0 |= LSI_SSTAT0_RST;
1692 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1693 }
1694 } else {
1695 s->sstat0 &= ~LSI_SSTAT0_RST;
1696 }
1697 break;
1698 case 0x02: /* SCNTL2 */
1699 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1700 s->scntl2 = val;
1701 break;
1702 case 0x03: /* SCNTL3 */
1703 s->scntl3 = val;
1704 break;
1705 case 0x04: /* SCID */
1706 s->scid = val;
1707 break;
1708 case 0x05: /* SXFER */
1709 s->sxfer = val;
1710 break;
1711 case 0x06: /* SDID */
1712 if ((s->ssid & 0x80) && (val & 0xf) != (s->ssid & 0xf)) {
1713 BADF("Destination ID does not match SSID\n");
1714 }
1715 s->sdid = val & 0xf;
1716 break;
1717 case 0x07: /* GPREG0 */
1718 break;
1719 case 0x08: /* SFBR */
1720 /* The CPU is not allowed to write to this register. However the
1721 SCRIPTS register move instructions are. */
1722 s->sfbr = val;
1723 break;
1724 case 0x0a: case 0x0b:
1725 /* Openserver writes to these readonly registers on startup */
1726 return;
1727 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1728 /* Linux writes to these readonly registers on startup. */
1729 return;
1730 CASE_SET_REG32(dsa, 0x10)
1731 case 0x14: /* ISTAT0 */
1732 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1733 if (val & LSI_ISTAT0_ABRT) {
1734 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1735 }
1736 if (val & LSI_ISTAT0_INTF) {
1737 s->istat0 &= ~LSI_ISTAT0_INTF;
1738 lsi_update_irq(s);
1739 }
1740 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1741 DPRINTF("Woken by SIGP\n");
1742 s->waiting = 0;
1743 s->dsp = s->dnad;
1744 lsi_execute_script(s);
1745 }
1746 if (val & LSI_ISTAT0_SRST) {
1747 qdev_reset_all(DEVICE(s));
1748 }
1749 break;
1750 case 0x16: /* MBOX0 */
1751 s->mbox0 = val;
1752 break;
1753 case 0x17: /* MBOX1 */
1754 s->mbox1 = val;
1755 break;
1756 case 0x18: /* CTEST0 */
1757 /* nothing to do */
1758 break;
1759 case 0x1a: /* CTEST2 */
1760 s->ctest2 = val & LSI_CTEST2_PCICIE;
1761 break;
1762 case 0x1b: /* CTEST3 */
1763 s->ctest3 = val & 0x0f;
1764 break;
1765 CASE_SET_REG32(temp, 0x1c)
1766 case 0x21: /* CTEST4 */
1767 if (val & 7) {
1768 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1769 }
1770 s->ctest4 = val;
1771 break;
1772 case 0x22: /* CTEST5 */
1773 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1774 BADF("CTEST5 DMA increment not implemented\n");
1775 }
1776 s->ctest5 = val;
1777 break;
1778 CASE_SET_REG24(dbc, 0x24)
1779 CASE_SET_REG32(dnad, 0x28)
1780 case 0x2c: /* DSP[0:7] */
1781 s->dsp &= 0xffffff00;
1782 s->dsp |= val;
1783 break;
1784 case 0x2d: /* DSP[8:15] */
1785 s->dsp &= 0xffff00ff;
1786 s->dsp |= val << 8;
1787 break;
1788 case 0x2e: /* DSP[16:23] */
1789 s->dsp &= 0xff00ffff;
1790 s->dsp |= val << 16;
1791 break;
1792 case 0x2f: /* DSP[24:31] */
1793 s->dsp &= 0x00ffffff;
1794 s->dsp |= val << 24;
1795 if ((s->dmode & LSI_DMODE_MAN) == 0
1796 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1797 lsi_execute_script(s);
1798 break;
1799 CASE_SET_REG32(dsps, 0x30)
1800 CASE_SET_REG32(scratch[0], 0x34)
1801 case 0x38: /* DMODE */
1802 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1803 BADF("IO mappings not implemented\n");
1804 }
1805 s->dmode = val;
1806 break;
1807 case 0x39: /* DIEN */
1808 s->dien = val;
1809 lsi_update_irq(s);
1810 break;
1811 case 0x3a: /* SBR */
1812 s->sbr = val;
1813 break;
1814 case 0x3b: /* DCNTL */
1815 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1816 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1817 lsi_execute_script(s);
1818 break;
1819 case 0x40: /* SIEN0 */
1820 s->sien0 = val;
1821 lsi_update_irq(s);
1822 break;
1823 case 0x41: /* SIEN1 */
1824 s->sien1 = val;
1825 lsi_update_irq(s);
1826 break;
1827 case 0x47: /* GPCNTL0 */
1828 break;
1829 case 0x48: /* STIME0 */
1830 s->stime0 = val;
1831 break;
1832 case 0x49: /* STIME1 */
1833 if (val & 0xf) {
1834 DPRINTF("General purpose timer not implemented\n");
1835 /* ??? Raising the interrupt immediately seems to be sufficient
1836 to keep the FreeBSD driver happy. */
1837 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1838 }
1839 break;
1840 case 0x4a: /* RESPID0 */
1841 s->respid0 = val;
1842 break;
1843 case 0x4b: /* RESPID1 */
1844 s->respid1 = val;
1845 break;
1846 case 0x4d: /* STEST1 */
1847 s->stest1 = val;
1848 break;
1849 case 0x4e: /* STEST2 */
1850 if (val & 1) {
1851 BADF("Low level mode not implemented\n");
1852 }
1853 s->stest2 = val;
1854 break;
1855 case 0x4f: /* STEST3 */
1856 if (val & 0x41) {
1857 BADF("SCSI FIFO test mode not implemented\n");
1858 }
1859 s->stest3 = val;
1860 break;
1861 case 0x56: /* CCNTL0 */
1862 s->ccntl0 = val;
1863 break;
1864 case 0x57: /* CCNTL1 */
1865 s->ccntl1 = val;
1866 break;
1867 CASE_SET_REG32(mmrs, 0xa0)
1868 CASE_SET_REG32(mmws, 0xa4)
1869 CASE_SET_REG32(sfs, 0xa8)
1870 CASE_SET_REG32(drs, 0xac)
1871 CASE_SET_REG32(sbms, 0xb0)
1872 CASE_SET_REG32(dbms, 0xb4)
1873 CASE_SET_REG32(dnad64, 0xb8)
1874 CASE_SET_REG32(pmjad1, 0xc0)
1875 CASE_SET_REG32(pmjad2, 0xc4)
1876 CASE_SET_REG32(rbc, 0xc8)
1877 CASE_SET_REG32(ua, 0xcc)
1878 CASE_SET_REG32(ia, 0xd4)
1879 CASE_SET_REG32(sbc, 0xd8)
1880 CASE_SET_REG32(csbc, 0xdc)
1881 default:
1882 if (offset >= 0x5c && offset < 0xa0) {
1883 int n;
1884 int shift;
1885 n = (offset - 0x58) >> 2;
1886 shift = (offset & 3) * 8;
1887 s->scratch[n] = deposit32(s->scratch[n], shift, 8, val);
1888 } else {
1889 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1890 }
1891 }
1892 #undef CASE_SET_REG24
1893 #undef CASE_SET_REG32
1894 }
1895
1896 static void lsi_mmio_write(void *opaque, hwaddr addr,
1897 uint64_t val, unsigned size)
1898 {
1899 LSIState *s = opaque;
1900
1901 lsi_reg_writeb(s, addr & 0xff, val);
1902 }
1903
1904 static uint64_t lsi_mmio_read(void *opaque, hwaddr addr,
1905 unsigned size)
1906 {
1907 LSIState *s = opaque;
1908
1909 return lsi_reg_readb(s, addr & 0xff);
1910 }
1911
1912 static const MemoryRegionOps lsi_mmio_ops = {
1913 .read = lsi_mmio_read,
1914 .write = lsi_mmio_write,
1915 .endianness = DEVICE_NATIVE_ENDIAN,
1916 .impl = {
1917 .min_access_size = 1,
1918 .max_access_size = 1,
1919 },
1920 };
1921
1922 static void lsi_ram_write(void *opaque, hwaddr addr,
1923 uint64_t val, unsigned size)
1924 {
1925 LSIState *s = opaque;
1926 uint32_t newval;
1927 uint32_t mask;
1928 int shift;
1929
1930 newval = s->script_ram[addr >> 2];
1931 shift = (addr & 3) * 8;
1932 mask = ((uint64_t)1 << (size * 8)) - 1;
1933 newval &= ~(mask << shift);
1934 newval |= val << shift;
1935 s->script_ram[addr >> 2] = newval;
1936 }
1937
1938 static uint64_t lsi_ram_read(void *opaque, hwaddr addr,
1939 unsigned size)
1940 {
1941 LSIState *s = opaque;
1942 uint32_t val;
1943 uint32_t mask;
1944
1945 val = s->script_ram[addr >> 2];
1946 mask = ((uint64_t)1 << (size * 8)) - 1;
1947 val >>= (addr & 3) * 8;
1948 return val & mask;
1949 }
1950
1951 static const MemoryRegionOps lsi_ram_ops = {
1952 .read = lsi_ram_read,
1953 .write = lsi_ram_write,
1954 .endianness = DEVICE_NATIVE_ENDIAN,
1955 };
1956
1957 static uint64_t lsi_io_read(void *opaque, hwaddr addr,
1958 unsigned size)
1959 {
1960 LSIState *s = opaque;
1961 return lsi_reg_readb(s, addr & 0xff);
1962 }
1963
1964 static void lsi_io_write(void *opaque, hwaddr addr,
1965 uint64_t val, unsigned size)
1966 {
1967 LSIState *s = opaque;
1968 lsi_reg_writeb(s, addr & 0xff, val);
1969 }
1970
1971 static const MemoryRegionOps lsi_io_ops = {
1972 .read = lsi_io_read,
1973 .write = lsi_io_write,
1974 .endianness = DEVICE_NATIVE_ENDIAN,
1975 .impl = {
1976 .min_access_size = 1,
1977 .max_access_size = 1,
1978 },
1979 };
1980
1981 static void lsi_scsi_reset(DeviceState *dev)
1982 {
1983 LSIState *s = LSI53C895A(dev);
1984
1985 lsi_soft_reset(s);
1986 }
1987
1988 static void lsi_pre_save(void *opaque)
1989 {
1990 LSIState *s = opaque;
1991
1992 if (s->current) {
1993 assert(s->current->dma_buf == NULL);
1994 assert(s->current->dma_len == 0);
1995 }
1996 assert(QTAILQ_EMPTY(&s->queue));
1997 }
1998
1999 static const VMStateDescription vmstate_lsi_scsi = {
2000 .name = "lsiscsi",
2001 .version_id = 0,
2002 .minimum_version_id = 0,
2003 .pre_save = lsi_pre_save,
2004 .fields = (VMStateField[]) {
2005 VMSTATE_PCI_DEVICE(parent_obj, LSIState),
2006
2007 VMSTATE_INT32(carry, LSIState),
2008 VMSTATE_INT32(status, LSIState),
2009 VMSTATE_INT32(msg_action, LSIState),
2010 VMSTATE_INT32(msg_len, LSIState),
2011 VMSTATE_BUFFER(msg, LSIState),
2012 VMSTATE_INT32(waiting, LSIState),
2013
2014 VMSTATE_UINT32(dsa, LSIState),
2015 VMSTATE_UINT32(temp, LSIState),
2016 VMSTATE_UINT32(dnad, LSIState),
2017 VMSTATE_UINT32(dbc, LSIState),
2018 VMSTATE_UINT8(istat0, LSIState),
2019 VMSTATE_UINT8(istat1, LSIState),
2020 VMSTATE_UINT8(dcmd, LSIState),
2021 VMSTATE_UINT8(dstat, LSIState),
2022 VMSTATE_UINT8(dien, LSIState),
2023 VMSTATE_UINT8(sist0, LSIState),
2024 VMSTATE_UINT8(sist1, LSIState),
2025 VMSTATE_UINT8(sien0, LSIState),
2026 VMSTATE_UINT8(sien1, LSIState),
2027 VMSTATE_UINT8(mbox0, LSIState),
2028 VMSTATE_UINT8(mbox1, LSIState),
2029 VMSTATE_UINT8(dfifo, LSIState),
2030 VMSTATE_UINT8(ctest2, LSIState),
2031 VMSTATE_UINT8(ctest3, LSIState),
2032 VMSTATE_UINT8(ctest4, LSIState),
2033 VMSTATE_UINT8(ctest5, LSIState),
2034 VMSTATE_UINT8(ccntl0, LSIState),
2035 VMSTATE_UINT8(ccntl1, LSIState),
2036 VMSTATE_UINT32(dsp, LSIState),
2037 VMSTATE_UINT32(dsps, LSIState),
2038 VMSTATE_UINT8(dmode, LSIState),
2039 VMSTATE_UINT8(dcntl, LSIState),
2040 VMSTATE_UINT8(scntl0, LSIState),
2041 VMSTATE_UINT8(scntl1, LSIState),
2042 VMSTATE_UINT8(scntl2, LSIState),
2043 VMSTATE_UINT8(scntl3, LSIState),
2044 VMSTATE_UINT8(sstat0, LSIState),
2045 VMSTATE_UINT8(sstat1, LSIState),
2046 VMSTATE_UINT8(scid, LSIState),
2047 VMSTATE_UINT8(sxfer, LSIState),
2048 VMSTATE_UINT8(socl, LSIState),
2049 VMSTATE_UINT8(sdid, LSIState),
2050 VMSTATE_UINT8(ssid, LSIState),
2051 VMSTATE_UINT8(sfbr, LSIState),
2052 VMSTATE_UINT8(stest1, LSIState),
2053 VMSTATE_UINT8(stest2, LSIState),
2054 VMSTATE_UINT8(stest3, LSIState),
2055 VMSTATE_UINT8(sidl, LSIState),
2056 VMSTATE_UINT8(stime0, LSIState),
2057 VMSTATE_UINT8(respid0, LSIState),
2058 VMSTATE_UINT8(respid1, LSIState),
2059 VMSTATE_UINT32(mmrs, LSIState),
2060 VMSTATE_UINT32(mmws, LSIState),
2061 VMSTATE_UINT32(sfs, LSIState),
2062 VMSTATE_UINT32(drs, LSIState),
2063 VMSTATE_UINT32(sbms, LSIState),
2064 VMSTATE_UINT32(dbms, LSIState),
2065 VMSTATE_UINT32(dnad64, LSIState),
2066 VMSTATE_UINT32(pmjad1, LSIState),
2067 VMSTATE_UINT32(pmjad2, LSIState),
2068 VMSTATE_UINT32(rbc, LSIState),
2069 VMSTATE_UINT32(ua, LSIState),
2070 VMSTATE_UINT32(ia, LSIState),
2071 VMSTATE_UINT32(sbc, LSIState),
2072 VMSTATE_UINT32(csbc, LSIState),
2073 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2074 VMSTATE_UINT8(sbr, LSIState),
2075
2076 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2077 VMSTATE_END_OF_LIST()
2078 }
2079 };
2080
2081 static const struct SCSIBusInfo lsi_scsi_info = {
2082 .tcq = true,
2083 .max_target = LSI_MAX_DEVS,
2084 .max_lun = 0, /* LUN support is buggy */
2085
2086 .transfer_data = lsi_transfer_data,
2087 .complete = lsi_command_complete,
2088 .cancel = lsi_request_cancelled
2089 };
2090
2091 static void lsi_scsi_realize(PCIDevice *dev, Error **errp)
2092 {
2093 LSIState *s = LSI53C895A(dev);
2094 DeviceState *d = DEVICE(dev);
2095 uint8_t *pci_conf;
2096
2097 pci_conf = dev->config;
2098
2099 /* PCI latency timer = 255 */
2100 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2101 /* Interrupt pin A */
2102 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2103
2104 memory_region_init_io(&s->mmio_io, OBJECT(s), &lsi_mmio_ops, s,
2105 "lsi-mmio", 0x400);
2106 memory_region_init_io(&s->ram_io, OBJECT(s), &lsi_ram_ops, s,
2107 "lsi-ram", 0x2000);
2108 memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s,
2109 "lsi-io", 256);
2110
2111 pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2112 pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mmio_io);
2113 pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
2114 QTAILQ_INIT(&s->queue);
2115
2116 scsi_bus_new(&s->bus, sizeof(s->bus), d, &lsi_scsi_info, NULL);
2117 if (!d->hotplugged) {
2118 scsi_bus_legacy_handle_cmdline(&s->bus, errp);
2119 }
2120 }
2121
2122 static void lsi_class_init(ObjectClass *klass, void *data)
2123 {
2124 DeviceClass *dc = DEVICE_CLASS(klass);
2125 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2126
2127 k->realize = lsi_scsi_realize;
2128 k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2129 k->device_id = PCI_DEVICE_ID_LSI_53C895A;
2130 k->class_id = PCI_CLASS_STORAGE_SCSI;
2131 k->subsystem_id = 0x1000;
2132 dc->reset = lsi_scsi_reset;
2133 dc->vmsd = &vmstate_lsi_scsi;
2134 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2135 }
2136
2137 static const TypeInfo lsi_info = {
2138 .name = TYPE_LSI53C895A,
2139 .parent = TYPE_PCI_DEVICE,
2140 .instance_size = sizeof(LSIState),
2141 .class_init = lsi_class_init,
2142 };
2143
2144 static void lsi53c810_class_init(ObjectClass *klass, void *data)
2145 {
2146 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2147
2148 k->device_id = PCI_DEVICE_ID_LSI_53C810;
2149 }
2150
2151 static TypeInfo lsi53c810_info = {
2152 .name = TYPE_LSI53C810,
2153 .parent = TYPE_LSI53C895A,
2154 .class_init = lsi53c810_class_init,
2155 };
2156
2157 static void lsi53c895a_register_types(void)
2158 {
2159 type_register_static(&lsi_info);
2160 type_register_static(&lsi53c810_info);
2161 }
2162
2163 type_init(lsi53c895a_register_types)
AR7 emulation for QEMU