]> git.proxmox.com Git - mirror_qemu.git/blob - hw/lsi53c895a.c
projects / mirror_qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
pci: convert PCIUnregisterFunc to void
[mirror_qemu.git] / hw / lsi53c895a.c
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licensed under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h>
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18 #include "dma.h"
19
20 //#define DEBUG_LSI
21 //#define DEBUG_LSI_REG
22
23 #ifdef DEBUG_LSI
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
28 #else
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
32 #endif
33
34 #define LSI_MAX_DEVS 7
35
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
41
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
50
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
59
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
68
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
72
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
81
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
90
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
95
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
104
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
112
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
121
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
128
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
137
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
144
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
150
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
156
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
159
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
161
162 #define PHASE_DO 0
163 #define PHASE_DI 1
164 #define PHASE_CMD 2
165 #define PHASE_ST 3
166 #define PHASE_MO 6
167 #define PHASE_MI 7
168 #define PHASE_MASK 7
169
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
172
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
175
176 typedef struct lsi_request {
177 SCSIRequest *req;
178 uint32_t tag;
179 uint32_t dma_len;
180 uint8_t *dma_buf;
181 uint32_t pending;
182 int out;
183 QTAILQ_ENTRY(lsi_request) next;
184 } lsi_request;
185
186 typedef struct {
187 PCIDevice dev;
188 MemoryRegion mmio_io;
189 MemoryRegion ram_io;
190 MemoryRegion io_io;
191
192 int carry; /* ??? Should this be an a visible register somewhere? */
193 int status;
194 /* Action to take at the end of a MSG IN phase.
195 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
196 int msg_action;
197 int msg_len;
198 uint8_t msg[LSI_MAX_MSGIN_LEN];
199 /* 0 if SCRIPTS are running or stopped.
200 * 1 if a Wait Reselect instruction has been issued.
201 * 2 if processing DMA from lsi_execute_script.
202 * 3 if a DMA operation is in progress. */
203 int waiting;
204 SCSIBus bus;
205 int current_lun;
206 /* The tag is a combination of the device ID and the SCSI tag. */
207 uint32_t select_tag;
208 int command_complete;
209 QTAILQ_HEAD(, lsi_request) queue;
210 lsi_request *current;
211
212 uint32_t dsa;
213 uint32_t temp;
214 uint32_t dnad;
215 uint32_t dbc;
216 uint8_t istat0;
217 uint8_t istat1;
218 uint8_t dcmd;
219 uint8_t dstat;
220 uint8_t dien;
221 uint8_t sist0;
222 uint8_t sist1;
223 uint8_t sien0;
224 uint8_t sien1;
225 uint8_t mbox0;
226 uint8_t mbox1;
227 uint8_t dfifo;
228 uint8_t ctest2;
229 uint8_t ctest3;
230 uint8_t ctest4;
231 uint8_t ctest5;
232 uint8_t ccntl0;
233 uint8_t ccntl1;
234 uint32_t dsp;
235 uint32_t dsps;
236 uint8_t dmode;
237 uint8_t dcntl;
238 uint8_t scntl0;
239 uint8_t scntl1;
240 uint8_t scntl2;
241 uint8_t scntl3;
242 uint8_t sstat0;
243 uint8_t sstat1;
244 uint8_t scid;
245 uint8_t sxfer;
246 uint8_t socl;
247 uint8_t sdid;
248 uint8_t ssid;
249 uint8_t sfbr;
250 uint8_t stest1;
251 uint8_t stest2;
252 uint8_t stest3;
253 uint8_t sidl;
254 uint8_t stime0;
255 uint8_t respid0;
256 uint8_t respid1;
257 uint32_t mmrs;
258 uint32_t mmws;
259 uint32_t sfs;
260 uint32_t drs;
261 uint32_t sbms;
262 uint32_t dbms;
263 uint32_t dnad64;
264 uint32_t pmjad1;
265 uint32_t pmjad2;
266 uint32_t rbc;
267 uint32_t ua;
268 uint32_t ia;
269 uint32_t sbc;
270 uint32_t csbc;
271 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
272 uint8_t sbr;
273
274 /* Script ram is stored as 32-bit words in host byteorder. */
275 uint32_t script_ram[2048];
276 } LSIState;
277
278 static inline int lsi_irq_on_rsl(LSIState *s)
279 {
280 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
281 }
282
283 static void lsi_soft_reset(LSIState *s)
284 {
285 lsi_request *p;
286
287 DPRINTF("Reset\n");
288 s->carry = 0;
289
290 s->msg_action = 0;
291 s->msg_len = 0;
292 s->waiting = 0;
293 s->dsa = 0;
294 s->dnad = 0;
295 s->dbc = 0;
296 s->temp = 0;
297 memset(s->scratch, 0, sizeof(s->scratch));
298 s->istat0 = 0;
299 s->istat1 = 0;
300 s->dcmd = 0x40;
301 s->dstat = LSI_DSTAT_DFE;
302 s->dien = 0;
303 s->sist0 = 0;
304 s->sist1 = 0;
305 s->sien0 = 0;
306 s->sien1 = 0;
307 s->mbox0 = 0;
308 s->mbox1 = 0;
309 s->dfifo = 0;
310 s->ctest2 = LSI_CTEST2_DACK;
311 s->ctest3 = 0;
312 s->ctest4 = 0;
313 s->ctest5 = 0;
314 s->ccntl0 = 0;
315 s->ccntl1 = 0;
316 s->dsp = 0;
317 s->dsps = 0;
318 s->dmode = 0;
319 s->dcntl = 0;
320 s->scntl0 = 0xc0;
321 s->scntl1 = 0;
322 s->scntl2 = 0;
323 s->scntl3 = 0;
324 s->sstat0 = 0;
325 s->sstat1 = 0;
326 s->scid = 7;
327 s->sxfer = 0;
328 s->socl = 0;
329 s->sdid = 0;
330 s->ssid = 0;
331 s->stest1 = 0;
332 s->stest2 = 0;
333 s->stest3 = 0;
334 s->sidl = 0;
335 s->stime0 = 0;
336 s->respid0 = 0x80;
337 s->respid1 = 0;
338 s->mmrs = 0;
339 s->mmws = 0;
340 s->sfs = 0;
341 s->drs = 0;
342 s->sbms = 0;
343 s->dbms = 0;
344 s->dnad64 = 0;
345 s->pmjad1 = 0;
346 s->pmjad2 = 0;
347 s->rbc = 0;
348 s->ua = 0;
349 s->ia = 0;
350 s->sbc = 0;
351 s->csbc = 0;
352 s->sbr = 0;
353 while (!QTAILQ_EMPTY(&s->queue)) {
354 p = QTAILQ_FIRST(&s->queue);
355 QTAILQ_REMOVE(&s->queue, p, next);
356 g_free(p);
357 }
358 if (s->current) {
359 g_free(s->current);
360 s->current = NULL;
361 }
362 }
363
364 static int lsi_dma_40bit(LSIState *s)
365 {
366 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
367 return 1;
368 return 0;
369 }
370
371 static int lsi_dma_ti64bit(LSIState *s)
372 {
373 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
374 return 1;
375 return 0;
376 }
377
378 static int lsi_dma_64bit(LSIState *s)
379 {
380 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
381 return 1;
382 return 0;
383 }
384
385 static uint8_t lsi_reg_readb(LSIState *s, int offset);
386 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
387 static void lsi_execute_script(LSIState *s);
388 static void lsi_reselect(LSIState *s, lsi_request *p);
389
390 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
391 {
392 uint32_t buf;
393
394 pci_dma_read(&s->dev, addr, &buf, 4);
395 return cpu_to_le32(buf);
396 }
397
398 static void lsi_stop_script(LSIState *s)
399 {
400 s->istat1 &= ~LSI_ISTAT1_SRUN;
401 }
402
403 static void lsi_update_irq(LSIState *s)
404 {
405 int level;
406 static int last_level;
407 lsi_request *p;
408
409 /* It's unclear whether the DIP/SIP bits should be cleared when the
410 Interrupt Status Registers are cleared or when istat0 is read.
411 We currently do the formwer, which seems to work. */
412 level = 0;
413 if (s->dstat) {
414 if (s->dstat & s->dien)
415 level = 1;
416 s->istat0 |= LSI_ISTAT0_DIP;
417 } else {
418 s->istat0 &= ~LSI_ISTAT0_DIP;
419 }
420
421 if (s->sist0 || s->sist1) {
422 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
423 level = 1;
424 s->istat0 |= LSI_ISTAT0_SIP;
425 } else {
426 s->istat0 &= ~LSI_ISTAT0_SIP;
427 }
428 if (s->istat0 & LSI_ISTAT0_INTF)
429 level = 1;
430
431 if (level != last_level) {
432 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
433 level, s->dstat, s->sist1, s->sist0);
434 last_level = level;
435 }
436 qemu_set_irq(s->dev.irq[0], level);
437
438 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
439 DPRINTF("Handled IRQs & disconnected, looking for pending "
440 "processes\n");
441 QTAILQ_FOREACH(p, &s->queue, next) {
442 if (p->pending) {
443 lsi_reselect(s, p);
444 break;
445 }
446 }
447 }
448 }
449
450 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
451 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
452 {
453 uint32_t mask0;
454 uint32_t mask1;
455
456 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
457 stat1, stat0, s->sist1, s->sist0);
458 s->sist0 |= stat0;
459 s->sist1 |= stat1;
460 /* Stop processor on fatal or unmasked interrupt. As a special hack
461 we don't stop processing when raising STO. Instead continue
462 execution and stop at the next insn that accesses the SCSI bus. */
463 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
464 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
465 mask1 &= ~LSI_SIST1_STO;
466 if (s->sist0 & mask0 || s->sist1 & mask1) {
467 lsi_stop_script(s);
468 }
469 lsi_update_irq(s);
470 }
471
472 /* Stop SCRIPTS execution and raise a DMA interrupt. */
473 static void lsi_script_dma_interrupt(LSIState *s, int stat)
474 {
475 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
476 s->dstat |= stat;
477 lsi_update_irq(s);
478 lsi_stop_script(s);
479 }
480
481 static inline void lsi_set_phase(LSIState *s, int phase)
482 {
483 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
484 }
485
486 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
487 {
488 /* Trigger a phase mismatch. */
489 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
490 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
491 s->dsp = out ? s->pmjad1 : s->pmjad2;
492 } else {
493 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
494 }
495 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
496 } else {
497 DPRINTF("Phase mismatch interrupt\n");
498 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
499 lsi_stop_script(s);
500 }
501 lsi_set_phase(s, new_phase);
502 }
503
504
505 /* Resume SCRIPTS execution after a DMA operation. */
506 static void lsi_resume_script(LSIState *s)
507 {
508 if (s->waiting != 2) {
509 s->waiting = 0;
510 lsi_execute_script(s);
511 } else {
512 s->waiting = 0;
513 }
514 }
515
516 static void lsi_disconnect(LSIState *s)
517 {
518 s->scntl1 &= ~LSI_SCNTL1_CON;
519 s->sstat1 &= ~PHASE_MASK;
520 }
521
522 static void lsi_bad_selection(LSIState *s, uint32_t id)
523 {
524 DPRINTF("Selected absent target %d\n", id);
525 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
526 lsi_disconnect(s);
527 }
528
529 /* Initiate a SCSI layer data transfer. */
530 static void lsi_do_dma(LSIState *s, int out)
531 {
532 uint32_t count;
533 dma_addr_t addr;
534 SCSIDevice *dev;
535
536 assert(s->current);
537 if (!s->current->dma_len) {
538 /* Wait until data is available. */
539 DPRINTF("DMA no data available\n");
540 return;
541 }
542
543 dev = s->current->req->dev;
544 assert(dev);
545
546 count = s->dbc;
547 if (count > s->current->dma_len)
548 count = s->current->dma_len;
549
550 addr = s->dnad;
551 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
552 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
553 addr |= ((uint64_t)s->dnad64 << 32);
554 else if (s->dbms)
555 addr |= ((uint64_t)s->dbms << 32);
556 else if (s->sbms)
557 addr |= ((uint64_t)s->sbms << 32);
558
559 DPRINTF("DMA addr=0x" DMA_ADDR_FMT " len=%d\n", addr, count);
560 s->csbc += count;
561 s->dnad += count;
562 s->dbc -= count;
563 if (s->current->dma_buf == NULL) {
564 s->current->dma_buf = scsi_req_get_buf(s->current->req);
565 }
566 /* ??? Set SFBR to first data byte. */
567 if (out) {
568 pci_dma_read(&s->dev, addr, s->current->dma_buf, count);
569 } else {
570 pci_dma_write(&s->dev, addr, s->current->dma_buf, count);
571 }
572 s->current->dma_len -= count;
573 if (s->current->dma_len == 0) {
574 s->current->dma_buf = NULL;
575 scsi_req_continue(s->current->req);
576 } else {
577 s->current->dma_buf += count;
578 lsi_resume_script(s);
579 }
580 }
581
582
583 /* Add a command to the queue. */
584 static void lsi_queue_command(LSIState *s)
585 {
586 lsi_request *p = s->current;
587
588 DPRINTF("Queueing tag=0x%x\n", p->tag);
589 assert(s->current != NULL);
590 assert(s->current->dma_len == 0);
591 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
592 s->current = NULL;
593
594 p->pending = 0;
595 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
596 }
597
598 /* Queue a byte for a MSG IN phase. */
599 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
600 {
601 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
602 BADF("MSG IN data too long\n");
603 } else {
604 DPRINTF("MSG IN 0x%02x\n", data);
605 s->msg[s->msg_len++] = data;
606 }
607 }
608
609 /* Perform reselection to continue a command. */
610 static void lsi_reselect(LSIState *s, lsi_request *p)
611 {
612 int id;
613
614 assert(s->current == NULL);
615 QTAILQ_REMOVE(&s->queue, p, next);
616 s->current = p;
617
618 id = (p->tag >> 8) & 0xf;
619 s->ssid = id | 0x80;
620 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
621 if (!(s->dcntl & LSI_DCNTL_COM)) {
622 s->sfbr = 1 << (id & 0x7);
623 }
624 DPRINTF("Reselected target %d\n", id);
625 s->scntl1 |= LSI_SCNTL1_CON;
626 lsi_set_phase(s, PHASE_MI);
627 s->msg_action = p->out ? 2 : 3;
628 s->current->dma_len = p->pending;
629 lsi_add_msg_byte(s, 0x80);
630 if (s->current->tag & LSI_TAG_VALID) {
631 lsi_add_msg_byte(s, 0x20);
632 lsi_add_msg_byte(s, p->tag & 0xff);
633 }
634
635 if (lsi_irq_on_rsl(s)) {
636 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
637 }
638 }
639
640 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
641 {
642 lsi_request *p;
643
644 QTAILQ_FOREACH(p, &s->queue, next) {
645 if (p->tag == tag) {
646 return p;
647 }
648 }
649
650 return NULL;
651 }
652
653 static void lsi_request_cancelled(SCSIRequest *req)
654 {
655 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
656 lsi_request *p = req->hba_private;
657
658 if (s->current && req == s->current->req) {
659 scsi_req_unref(req);
660 g_free(s->current);
661 s->current = NULL;
662 return;
663 }
664
665 if (p) {
666 QTAILQ_REMOVE(&s->queue, p, next);
667 scsi_req_unref(req);
668 g_free(p);
669 }
670 }
671
672 /* Record that data is available for a queued command. Returns zero if
673 the device was reselected, nonzero if the IO is deferred. */
674 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
675 {
676 lsi_request *p = req->hba_private;
677
678 if (p->pending) {
679 BADF("Multiple IO pending for request %p\n", p);
680 }
681 p->pending = len;
682 /* Reselect if waiting for it, or if reselection triggers an IRQ
683 and the bus is free.
684 Since no interrupt stacking is implemented in the emulation, it
685 is also required that there are no pending interrupts waiting
686 for service from the device driver. */
687 if (s->waiting == 1 ||
688 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
689 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
690 /* Reselect device. */
691 lsi_reselect(s, p);
692 return 0;
693 } else {
694 DPRINTF("Queueing IO tag=0x%x\n", p->tag);
695 p->pending = len;
696 return 1;
697 }
698 }
699
700 /* Callback to indicate that the SCSI layer has completed a command. */
701 static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
702 {
703 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
704 int out;
705
706 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
707 DPRINTF("Command complete status=%d\n", (int)status);
708 s->status = status;
709 s->command_complete = 2;
710 if (s->waiting && s->dbc != 0) {
711 /* Raise phase mismatch for short transfers. */
712 lsi_bad_phase(s, out, PHASE_ST);
713 } else {
714 lsi_set_phase(s, PHASE_ST);
715 }
716
717 if (s->current && req == s->current->req) {
718 scsi_req_unref(s->current->req);
719 g_free(s->current);
720 s->current = NULL;
721 }
722 lsi_resume_script(s);
723 }
724
725 /* Callback to indicate that the SCSI layer has completed a transfer. */
726 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
727 {
728 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
729 int out;
730
731 if (s->waiting == 1 || !s->current || req->hba_private != s->current ||
732 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
733 if (lsi_queue_req(s, req, len)) {
734 return;
735 }
736 }
737
738 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
739
740 /* host adapter (re)connected */
741 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
742 s->current->dma_len = len;
743 s->command_complete = 1;
744 if (s->waiting) {
745 if (s->waiting == 1 || s->dbc == 0) {
746 lsi_resume_script(s);
747 } else {
748 lsi_do_dma(s, out);
749 }
750 }
751 }
752
753 static void lsi_do_command(LSIState *s)
754 {
755 SCSIDevice *dev;
756 uint8_t buf[16];
757 uint32_t id;
758 int n;
759
760 DPRINTF("Send command len=%d\n", s->dbc);
761 if (s->dbc > 16)
762 s->dbc = 16;
763 pci_dma_read(&s->dev, s->dnad, buf, s->dbc);
764 s->sfbr = buf[0];
765 s->command_complete = 0;
766
767 id = (s->select_tag >> 8) & 0xf;
768 dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
769 if (!dev) {
770 lsi_bad_selection(s, id);
771 return;
772 }
773
774 assert(s->current == NULL);
775 s->current = g_malloc0(sizeof(lsi_request));
776 s->current->tag = s->select_tag;
777 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
778 s->current);
779
780 n = scsi_req_enqueue(s->current->req);
781 if (n) {
782 if (n > 0) {
783 lsi_set_phase(s, PHASE_DI);
784 } else if (n < 0) {
785 lsi_set_phase(s, PHASE_DO);
786 }
787 scsi_req_continue(s->current->req);
788 }
789 if (!s->command_complete) {
790 if (n) {
791 /* Command did not complete immediately so disconnect. */
792 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
793 lsi_add_msg_byte(s, 4); /* DISCONNECT */
794 /* wait data */
795 lsi_set_phase(s, PHASE_MI);
796 s->msg_action = 1;
797 lsi_queue_command(s);
798 } else {
799 /* wait command complete */
800 lsi_set_phase(s, PHASE_DI);
801 }
802 }
803 }
804
805 static void lsi_do_status(LSIState *s)
806 {
807 uint8_t status;
808 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
809 if (s->dbc != 1)
810 BADF("Bad Status move\n");
811 s->dbc = 1;
812 status = s->status;
813 s->sfbr = status;
814 pci_dma_write(&s->dev, s->dnad, &status, 1);
815 lsi_set_phase(s, PHASE_MI);
816 s->msg_action = 1;
817 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
818 }
819
820 static void lsi_do_msgin(LSIState *s)
821 {
822 int len;
823 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
824 s->sfbr = s->msg[0];
825 len = s->msg_len;
826 if (len > s->dbc)
827 len = s->dbc;
828 pci_dma_write(&s->dev, s->dnad, s->msg, len);
829 /* Linux drivers rely on the last byte being in the SIDL. */
830 s->sidl = s->msg[len - 1];
831 s->msg_len -= len;
832 if (s->msg_len) {
833 memmove(s->msg, s->msg + len, s->msg_len);
834 } else {
835 /* ??? Check if ATN (not yet implemented) is asserted and maybe
836 switch to PHASE_MO. */
837 switch (s->msg_action) {
838 case 0:
839 lsi_set_phase(s, PHASE_CMD);
840 break;
841 case 1:
842 lsi_disconnect(s);
843 break;
844 case 2:
845 lsi_set_phase(s, PHASE_DO);
846 break;
847 case 3:
848 lsi_set_phase(s, PHASE_DI);
849 break;
850 default:
851 abort();
852 }
853 }
854 }
855
856 /* Read the next byte during a MSGOUT phase. */
857 static uint8_t lsi_get_msgbyte(LSIState *s)
858 {
859 uint8_t data;
860 pci_dma_read(&s->dev, s->dnad, &data, 1);
861 s->dnad++;
862 s->dbc--;
863 return data;
864 }
865
866 /* Skip the next n bytes during a MSGOUT phase. */
867 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
868 {
869 s->dnad += n;
870 s->dbc -= n;
871 }
872
873 static void lsi_do_msgout(LSIState *s)
874 {
875 uint8_t msg;
876 int len;
877 uint32_t current_tag;
878 lsi_request *current_req, *p, *p_next;
879
880 if (s->current) {
881 current_tag = s->current->tag;
882 current_req = s->current;
883 } else {
884 current_tag = s->select_tag;
885 current_req = lsi_find_by_tag(s, current_tag);
886 }
887
888 DPRINTF("MSG out len=%d\n", s->dbc);
889 while (s->dbc) {
890 msg = lsi_get_msgbyte(s);
891 s->sfbr = msg;
892
893 switch (msg) {
894 case 0x04:
895 DPRINTF("MSG: Disconnect\n");
896 lsi_disconnect(s);
897 break;
898 case 0x08:
899 DPRINTF("MSG: No Operation\n");
900 lsi_set_phase(s, PHASE_CMD);
901 break;
902 case 0x01:
903 len = lsi_get_msgbyte(s);
904 msg = lsi_get_msgbyte(s);
905 (void)len; /* avoid a warning about unused variable*/
906 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
907 switch (msg) {
908 case 1:
909 DPRINTF("SDTR (ignored)\n");
910 lsi_skip_msgbytes(s, 2);
911 break;
912 case 3:
913 DPRINTF("WDTR (ignored)\n");
914 lsi_skip_msgbytes(s, 1);
915 break;
916 default:
917 goto bad;
918 }
919 break;
920 case 0x20: /* SIMPLE queue */
921 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
922 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
923 break;
924 case 0x21: /* HEAD of queue */
925 BADF("HEAD queue not implemented\n");
926 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
927 break;
928 case 0x22: /* ORDERED queue */
929 BADF("ORDERED queue not implemented\n");
930 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
931 break;
932 case 0x0d:
933 /* The ABORT TAG message clears the current I/O process only. */
934 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
935 if (current_req) {
936 scsi_req_cancel(current_req->req);
937 }
938 lsi_disconnect(s);
939 break;
940 case 0x06:
941 case 0x0e:
942 case 0x0c:
943 /* The ABORT message clears all I/O processes for the selecting
944 initiator on the specified logical unit of the target. */
945 if (msg == 0x06) {
946 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
947 }
948 /* The CLEAR QUEUE message clears all I/O processes for all
949 initiators on the specified logical unit of the target. */
950 if (msg == 0x0e) {
951 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
952 }
953 /* The BUS DEVICE RESET message clears all I/O processes for all
954 initiators on all logical units of the target. */
955 if (msg == 0x0c) {
956 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
957 }
958
959 /* clear the current I/O process */
960 if (s->current) {
961 scsi_req_cancel(s->current->req);
962 }
963
964 /* As the current implemented devices scsi_disk and scsi_generic
965 only support one LUN, we don't need to keep track of LUNs.
966 Clearing I/O processes for other initiators could be possible
967 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
968 device, but this is currently not implemented (and seems not
969 to be really necessary). So let's simply clear all queued
970 commands for the current device: */
971 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
972 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
973 scsi_req_cancel(p->req);
974 }
975 }
976
977 lsi_disconnect(s);
978 break;
979 default:
980 if ((msg & 0x80) == 0) {
981 goto bad;
982 }
983 s->current_lun = msg & 7;
984 DPRINTF("Select LUN %d\n", s->current_lun);
985 lsi_set_phase(s, PHASE_CMD);
986 break;
987 }
988 }
989 return;
990 bad:
991 BADF("Unimplemented message 0x%02x\n", msg);
992 lsi_set_phase(s, PHASE_MI);
993 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
994 s->msg_action = 0;
995 }
996
997 /* Sign extend a 24-bit value. */
998 static inline int32_t sxt24(int32_t n)
999 {
1000 return (n << 8) >> 8;
1001 }
1002
1003 #define LSI_BUF_SIZE 4096
1004 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1005 {
1006 int n;
1007 uint8_t buf[LSI_BUF_SIZE];
1008
1009 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1010 while (count) {
1011 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1012 pci_dma_read(&s->dev, src, buf, n);
1013 pci_dma_write(&s->dev, dest, buf, n);
1014 src += n;
1015 dest += n;
1016 count -= n;
1017 }
1018 }
1019
1020 static void lsi_wait_reselect(LSIState *s)
1021 {
1022 lsi_request *p;
1023
1024 DPRINTF("Wait Reselect\n");
1025
1026 QTAILQ_FOREACH(p, &s->queue, next) {
1027 if (p->pending) {
1028 lsi_reselect(s, p);
1029 break;
1030 }
1031 }
1032 if (s->current == NULL) {
1033 s->waiting = 1;
1034 }
1035 }
1036
1037 static void lsi_execute_script(LSIState *s)
1038 {
1039 uint32_t insn;
1040 uint32_t addr, addr_high;
1041 int opcode;
1042 int insn_processed = 0;
1043
1044 s->istat1 |= LSI_ISTAT1_SRUN;
1045 again:
1046 insn_processed++;
1047 insn = read_dword(s, s->dsp);
1048 if (!insn) {
1049 /* If we receive an empty opcode increment the DSP by 4 bytes
1050 instead of 8 and execute the next opcode at that location */
1051 s->dsp += 4;
1052 goto again;
1053 }
1054 addr = read_dword(s, s->dsp + 4);
1055 addr_high = 0;
1056 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1057 s->dsps = addr;
1058 s->dcmd = insn >> 24;
1059 s->dsp += 8;
1060 switch (insn >> 30) {
1061 case 0: /* Block move. */
1062 if (s->sist1 & LSI_SIST1_STO) {
1063 DPRINTF("Delayed select timeout\n");
1064 lsi_stop_script(s);
1065 break;
1066 }
1067 s->dbc = insn & 0xffffff;
1068 s->rbc = s->dbc;
1069 /* ??? Set ESA. */
1070 s->ia = s->dsp - 8;
1071 if (insn & (1 << 29)) {
1072 /* Indirect addressing. */
1073 addr = read_dword(s, addr);
1074 } else if (insn & (1 << 28)) {
1075 uint32_t buf[2];
1076 int32_t offset;
1077 /* Table indirect addressing. */
1078
1079 /* 32-bit Table indirect */
1080 offset = sxt24(addr);
1081 pci_dma_read(&s->dev, s->dsa + offset, buf, 8);
1082 /* byte count is stored in bits 0:23 only */
1083 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1084 s->rbc = s->dbc;
1085 addr = cpu_to_le32(buf[1]);
1086
1087 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1088 * table, bits [31:24] */
1089 if (lsi_dma_40bit(s))
1090 addr_high = cpu_to_le32(buf[0]) >> 24;
1091 else if (lsi_dma_ti64bit(s)) {
1092 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1093 switch (selector) {
1094 case 0 ... 0x0f:
1095 /* offset index into scratch registers since
1096 * TI64 mode can use registers C to R */
1097 addr_high = s->scratch[2 + selector];
1098 break;
1099 case 0x10:
1100 addr_high = s->mmrs;
1101 break;
1102 case 0x11:
1103 addr_high = s->mmws;
1104 break;
1105 case 0x12:
1106 addr_high = s->sfs;
1107 break;
1108 case 0x13:
1109 addr_high = s->drs;
1110 break;
1111 case 0x14:
1112 addr_high = s->sbms;
1113 break;
1114 case 0x15:
1115 addr_high = s->dbms;
1116 break;
1117 default:
1118 BADF("Illegal selector specified (0x%x > 0x15)"
1119 " for 64-bit DMA block move", selector);
1120 break;
1121 }
1122 }
1123 } else if (lsi_dma_64bit(s)) {
1124 /* fetch a 3rd dword if 64-bit direct move is enabled and
1125 only if we're not doing table indirect or indirect addressing */
1126 s->dbms = read_dword(s, s->dsp);
1127 s->dsp += 4;
1128 s->ia = s->dsp - 12;
1129 }
1130 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1131 DPRINTF("Wrong phase got %d expected %d\n",
1132 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1133 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1134 break;
1135 }
1136 s->dnad = addr;
1137 s->dnad64 = addr_high;
1138 switch (s->sstat1 & 0x7) {
1139 case PHASE_DO:
1140 s->waiting = 2;
1141 lsi_do_dma(s, 1);
1142 if (s->waiting)
1143 s->waiting = 3;
1144 break;
1145 case PHASE_DI:
1146 s->waiting = 2;
1147 lsi_do_dma(s, 0);
1148 if (s->waiting)
1149 s->waiting = 3;
1150 break;
1151 case PHASE_CMD:
1152 lsi_do_command(s);
1153 break;
1154 case PHASE_ST:
1155 lsi_do_status(s);
1156 break;
1157 case PHASE_MO:
1158 lsi_do_msgout(s);
1159 break;
1160 case PHASE_MI:
1161 lsi_do_msgin(s);
1162 break;
1163 default:
1164 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1165 exit(1);
1166 }
1167 s->dfifo = s->dbc & 0xff;
1168 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1169 s->sbc = s->dbc;
1170 s->rbc -= s->dbc;
1171 s->ua = addr + s->dbc;
1172 break;
1173
1174 case 1: /* IO or Read/Write instruction. */
1175 opcode = (insn >> 27) & 7;
1176 if (opcode < 5) {
1177 uint32_t id;
1178
1179 if (insn & (1 << 25)) {
1180 id = read_dword(s, s->dsa + sxt24(insn));
1181 } else {
1182 id = insn;
1183 }
1184 id = (id >> 16) & 0xf;
1185 if (insn & (1 << 26)) {
1186 addr = s->dsp + sxt24(addr);
1187 }
1188 s->dnad = addr;
1189 switch (opcode) {
1190 case 0: /* Select */
1191 s->sdid = id;
1192 if (s->scntl1 & LSI_SCNTL1_CON) {
1193 DPRINTF("Already reselected, jumping to alternative address\n");
1194 s->dsp = s->dnad;
1195 break;
1196 }
1197 s->sstat0 |= LSI_SSTAT0_WOA;
1198 s->scntl1 &= ~LSI_SCNTL1_IARB;
1199 if (!scsi_device_find(&s->bus, 0, id, 0)) {
1200 lsi_bad_selection(s, id);
1201 break;
1202 }
1203 DPRINTF("Selected target %d%s\n",
1204 id, insn & (1 << 3) ? " ATN" : "");
1205 /* ??? Linux drivers compain when this is set. Maybe
1206 it only applies in low-level mode (unimplemented).
1207 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1208 s->select_tag = id << 8;
1209 s->scntl1 |= LSI_SCNTL1_CON;
1210 if (insn & (1 << 3)) {
1211 s->socl |= LSI_SOCL_ATN;
1212 }
1213 lsi_set_phase(s, PHASE_MO);
1214 break;
1215 case 1: /* Disconnect */
1216 DPRINTF("Wait Disconnect\n");
1217 s->scntl1 &= ~LSI_SCNTL1_CON;
1218 break;
1219 case 2: /* Wait Reselect */
1220 if (!lsi_irq_on_rsl(s)) {
1221 lsi_wait_reselect(s);
1222 }
1223 break;
1224 case 3: /* Set */
1225 DPRINTF("Set%s%s%s%s\n",
1226 insn & (1 << 3) ? " ATN" : "",
1227 insn & (1 << 6) ? " ACK" : "",
1228 insn & (1 << 9) ? " TM" : "",
1229 insn & (1 << 10) ? " CC" : "");
1230 if (insn & (1 << 3)) {
1231 s->socl |= LSI_SOCL_ATN;
1232 lsi_set_phase(s, PHASE_MO);
1233 }
1234 if (insn & (1 << 9)) {
1235 BADF("Target mode not implemented\n");
1236 exit(1);
1237 }
1238 if (insn & (1 << 10))
1239 s->carry = 1;
1240 break;
1241 case 4: /* Clear */
1242 DPRINTF("Clear%s%s%s%s\n",
1243 insn & (1 << 3) ? " ATN" : "",
1244 insn & (1 << 6) ? " ACK" : "",
1245 insn & (1 << 9) ? " TM" : "",
1246 insn & (1 << 10) ? " CC" : "");
1247 if (insn & (1 << 3)) {
1248 s->socl &= ~LSI_SOCL_ATN;
1249 }
1250 if (insn & (1 << 10))
1251 s->carry = 0;
1252 break;
1253 }
1254 } else {
1255 uint8_t op0;
1256 uint8_t op1;
1257 uint8_t data8;
1258 int reg;
1259 int operator;
1260 #ifdef DEBUG_LSI
1261 static const char *opcode_names[3] =
1262 {"Write", "Read", "Read-Modify-Write"};
1263 static const char *operator_names[8] =
1264 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1265 #endif
1266
1267 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1268 data8 = (insn >> 8) & 0xff;
1269 opcode = (insn >> 27) & 7;
1270 operator = (insn >> 24) & 7;
1271 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1272 opcode_names[opcode - 5], reg,
1273 operator_names[operator], data8, s->sfbr,
1274 (insn & (1 << 23)) ? " SFBR" : "");
1275 op0 = op1 = 0;
1276 switch (opcode) {
1277 case 5: /* From SFBR */
1278 op0 = s->sfbr;
1279 op1 = data8;
1280 break;
1281 case 6: /* To SFBR */
1282 if (operator)
1283 op0 = lsi_reg_readb(s, reg);
1284 op1 = data8;
1285 break;
1286 case 7: /* Read-modify-write */
1287 if (operator)
1288 op0 = lsi_reg_readb(s, reg);
1289 if (insn & (1 << 23)) {
1290 op1 = s->sfbr;
1291 } else {
1292 op1 = data8;
1293 }
1294 break;
1295 }
1296
1297 switch (operator) {
1298 case 0: /* move */
1299 op0 = op1;
1300 break;
1301 case 1: /* Shift left */
1302 op1 = op0 >> 7;
1303 op0 = (op0 << 1) | s->carry;
1304 s->carry = op1;
1305 break;
1306 case 2: /* OR */
1307 op0 |= op1;
1308 break;
1309 case 3: /* XOR */
1310 op0 ^= op1;
1311 break;
1312 case 4: /* AND */
1313 op0 &= op1;
1314 break;
1315 case 5: /* SHR */
1316 op1 = op0 & 1;
1317 op0 = (op0 >> 1) | (s->carry << 7);
1318 s->carry = op1;
1319 break;
1320 case 6: /* ADD */
1321 op0 += op1;
1322 s->carry = op0 < op1;
1323 break;
1324 case 7: /* ADC */
1325 op0 += op1 + s->carry;
1326 if (s->carry)
1327 s->carry = op0 <= op1;
1328 else
1329 s->carry = op0 < op1;
1330 break;
1331 }
1332
1333 switch (opcode) {
1334 case 5: /* From SFBR */
1335 case 7: /* Read-modify-write */
1336 lsi_reg_writeb(s, reg, op0);
1337 break;
1338 case 6: /* To SFBR */
1339 s->sfbr = op0;
1340 break;
1341 }
1342 }
1343 break;
1344
1345 case 2: /* Transfer Control. */
1346 {
1347 int cond;
1348 int jmp;
1349
1350 if ((insn & 0x002e0000) == 0) {
1351 DPRINTF("NOP\n");
1352 break;
1353 }
1354 if (s->sist1 & LSI_SIST1_STO) {
1355 DPRINTF("Delayed select timeout\n");
1356 lsi_stop_script(s);
1357 break;
1358 }
1359 cond = jmp = (insn & (1 << 19)) != 0;
1360 if (cond == jmp && (insn & (1 << 21))) {
1361 DPRINTF("Compare carry %d\n", s->carry == jmp);
1362 cond = s->carry != 0;
1363 }
1364 if (cond == jmp && (insn & (1 << 17))) {
1365 DPRINTF("Compare phase %d %c= %d\n",
1366 (s->sstat1 & PHASE_MASK),
1367 jmp ? '=' : '!',
1368 ((insn >> 24) & 7));
1369 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1370 }
1371 if (cond == jmp && (insn & (1 << 18))) {
1372 uint8_t mask;
1373
1374 mask = (~insn >> 8) & 0xff;
1375 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1376 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1377 cond = (s->sfbr & mask) == (insn & mask);
1378 }
1379 if (cond == jmp) {
1380 if (insn & (1 << 23)) {
1381 /* Relative address. */
1382 addr = s->dsp + sxt24(addr);
1383 }
1384 switch ((insn >> 27) & 7) {
1385 case 0: /* Jump */
1386 DPRINTF("Jump to 0x%08x\n", addr);
1387 s->dsp = addr;
1388 break;
1389 case 1: /* Call */
1390 DPRINTF("Call 0x%08x\n", addr);
1391 s->temp = s->dsp;
1392 s->dsp = addr;
1393 break;
1394 case 2: /* Return */
1395 DPRINTF("Return to 0x%08x\n", s->temp);
1396 s->dsp = s->temp;
1397 break;
1398 case 3: /* Interrupt */
1399 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1400 if ((insn & (1 << 20)) != 0) {
1401 s->istat0 |= LSI_ISTAT0_INTF;
1402 lsi_update_irq(s);
1403 } else {
1404 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1405 }
1406 break;
1407 default:
1408 DPRINTF("Illegal transfer control\n");
1409 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1410 break;
1411 }
1412 } else {
1413 DPRINTF("Control condition failed\n");
1414 }
1415 }
1416 break;
1417
1418 case 3:
1419 if ((insn & (1 << 29)) == 0) {
1420 /* Memory move. */
1421 uint32_t dest;
1422 /* ??? The docs imply the destination address is loaded into
1423 the TEMP register. However the Linux drivers rely on
1424 the value being presrved. */
1425 dest = read_dword(s, s->dsp);
1426 s->dsp += 4;
1427 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1428 } else {
1429 uint8_t data[7];
1430 int reg;
1431 int n;
1432 int i;
1433
1434 if (insn & (1 << 28)) {
1435 addr = s->dsa + sxt24(addr);
1436 }
1437 n = (insn & 7);
1438 reg = (insn >> 16) & 0xff;
1439 if (insn & (1 << 24)) {
1440 pci_dma_read(&s->dev, addr, data, n);
1441 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1442 addr, *(int *)data);
1443 for (i = 0; i < n; i++) {
1444 lsi_reg_writeb(s, reg + i, data[i]);
1445 }
1446 } else {
1447 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1448 for (i = 0; i < n; i++) {
1449 data[i] = lsi_reg_readb(s, reg + i);
1450 }
1451 pci_dma_write(&s->dev, addr, data, n);
1452 }
1453 }
1454 }
1455 if (insn_processed > 10000 && !s->waiting) {
1456 /* Some windows drivers make the device spin waiting for a memory
1457 location to change. If we have been executed a lot of code then
1458 assume this is the case and force an unexpected device disconnect.
1459 This is apparently sufficient to beat the drivers into submission.
1460 */
1461 if (!(s->sien0 & LSI_SIST0_UDC))
1462 fprintf(stderr, "inf. loop with UDC masked\n");
1463 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1464 lsi_disconnect(s);
1465 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1466 if (s->dcntl & LSI_DCNTL_SSM) {
1467 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1468 } else {
1469 goto again;
1470 }
1471 }
1472 DPRINTF("SCRIPTS execution stopped\n");
1473 }
1474
1475 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1476 {
1477 uint8_t tmp;
1478 #define CASE_GET_REG24(name, addr) \
1479 case addr: return s->name & 0xff; \
1480 case addr + 1: return (s->name >> 8) & 0xff; \
1481 case addr + 2: return (s->name >> 16) & 0xff;
1482
1483 #define CASE_GET_REG32(name, addr) \
1484 case addr: return s->name & 0xff; \
1485 case addr + 1: return (s->name >> 8) & 0xff; \
1486 case addr + 2: return (s->name >> 16) & 0xff; \
1487 case addr + 3: return (s->name >> 24) & 0xff;
1488
1489 #ifdef DEBUG_LSI_REG
1490 DPRINTF("Read reg %x\n", offset);
1491 #endif
1492 switch (offset) {
1493 case 0x00: /* SCNTL0 */
1494 return s->scntl0;
1495 case 0x01: /* SCNTL1 */
1496 return s->scntl1;
1497 case 0x02: /* SCNTL2 */
1498 return s->scntl2;
1499 case 0x03: /* SCNTL3 */
1500 return s->scntl3;
1501 case 0x04: /* SCID */
1502 return s->scid;
1503 case 0x05: /* SXFER */
1504 return s->sxfer;
1505 case 0x06: /* SDID */
1506 return s->sdid;
1507 case 0x07: /* GPREG0 */
1508 return 0x7f;
1509 case 0x08: /* Revision ID */
1510 return 0x00;
1511 case 0xa: /* SSID */
1512 return s->ssid;
1513 case 0xb: /* SBCL */
1514 /* ??? This is not correct. However it's (hopefully) only
1515 used for diagnostics, so should be ok. */
1516 return 0;
1517 case 0xc: /* DSTAT */
1518 tmp = s->dstat | 0x80;
1519 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1520 s->dstat = 0;
1521 lsi_update_irq(s);
1522 return tmp;
1523 case 0x0d: /* SSTAT0 */
1524 return s->sstat0;
1525 case 0x0e: /* SSTAT1 */
1526 return s->sstat1;
1527 case 0x0f: /* SSTAT2 */
1528 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1529 CASE_GET_REG32(dsa, 0x10)
1530 case 0x14: /* ISTAT0 */
1531 return s->istat0;
1532 case 0x15: /* ISTAT1 */
1533 return s->istat1;
1534 case 0x16: /* MBOX0 */
1535 return s->mbox0;
1536 case 0x17: /* MBOX1 */
1537 return s->mbox1;
1538 case 0x18: /* CTEST0 */
1539 return 0xff;
1540 case 0x19: /* CTEST1 */
1541 return 0;
1542 case 0x1a: /* CTEST2 */
1543 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1544 if (s->istat0 & LSI_ISTAT0_SIGP) {
1545 s->istat0 &= ~LSI_ISTAT0_SIGP;
1546 tmp |= LSI_CTEST2_SIGP;
1547 }
1548 return tmp;
1549 case 0x1b: /* CTEST3 */
1550 return s->ctest3;
1551 CASE_GET_REG32(temp, 0x1c)
1552 case 0x20: /* DFIFO */
1553 return 0;
1554 case 0x21: /* CTEST4 */
1555 return s->ctest4;
1556 case 0x22: /* CTEST5 */
1557 return s->ctest5;
1558 case 0x23: /* CTEST6 */
1559 return 0;
1560 CASE_GET_REG24(dbc, 0x24)
1561 case 0x27: /* DCMD */
1562 return s->dcmd;
1563 CASE_GET_REG32(dnad, 0x28)
1564 CASE_GET_REG32(dsp, 0x2c)
1565 CASE_GET_REG32(dsps, 0x30)
1566 CASE_GET_REG32(scratch[0], 0x34)
1567 case 0x38: /* DMODE */
1568 return s->dmode;
1569 case 0x39: /* DIEN */
1570 return s->dien;
1571 case 0x3a: /* SBR */
1572 return s->sbr;
1573 case 0x3b: /* DCNTL */
1574 return s->dcntl;
1575 case 0x40: /* SIEN0 */
1576 return s->sien0;
1577 case 0x41: /* SIEN1 */
1578 return s->sien1;
1579 case 0x42: /* SIST0 */
1580 tmp = s->sist0;
1581 s->sist0 = 0;
1582 lsi_update_irq(s);
1583 return tmp;
1584 case 0x43: /* SIST1 */
1585 tmp = s->sist1;
1586 s->sist1 = 0;
1587 lsi_update_irq(s);
1588 return tmp;
1589 case 0x46: /* MACNTL */
1590 return 0x0f;
1591 case 0x47: /* GPCNTL0 */
1592 return 0x0f;
1593 case 0x48: /* STIME0 */
1594 return s->stime0;
1595 case 0x4a: /* RESPID0 */
1596 return s->respid0;
1597 case 0x4b: /* RESPID1 */
1598 return s->respid1;
1599 case 0x4d: /* STEST1 */
1600 return s->stest1;
1601 case 0x4e: /* STEST2 */
1602 return s->stest2;
1603 case 0x4f: /* STEST3 */
1604 return s->stest3;
1605 case 0x50: /* SIDL */
1606 /* This is needed by the linux drivers. We currently only update it
1607 during the MSG IN phase. */
1608 return s->sidl;
1609 case 0x52: /* STEST4 */
1610 return 0xe0;
1611 case 0x56: /* CCNTL0 */
1612 return s->ccntl0;
1613 case 0x57: /* CCNTL1 */
1614 return s->ccntl1;
1615 case 0x58: /* SBDL */
1616 /* Some drivers peek at the data bus during the MSG IN phase. */
1617 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1618 return s->msg[0];
1619 return 0;
1620 case 0x59: /* SBDL high */
1621 return 0;
1622 CASE_GET_REG32(mmrs, 0xa0)
1623 CASE_GET_REG32(mmws, 0xa4)
1624 CASE_GET_REG32(sfs, 0xa8)
1625 CASE_GET_REG32(drs, 0xac)
1626 CASE_GET_REG32(sbms, 0xb0)
1627 CASE_GET_REG32(dbms, 0xb4)
1628 CASE_GET_REG32(dnad64, 0xb8)
1629 CASE_GET_REG32(pmjad1, 0xc0)
1630 CASE_GET_REG32(pmjad2, 0xc4)
1631 CASE_GET_REG32(rbc, 0xc8)
1632 CASE_GET_REG32(ua, 0xcc)
1633 CASE_GET_REG32(ia, 0xd4)
1634 CASE_GET_REG32(sbc, 0xd8)
1635 CASE_GET_REG32(csbc, 0xdc)
1636 }
1637 if (offset >= 0x5c && offset < 0xa0) {
1638 int n;
1639 int shift;
1640 n = (offset - 0x58) >> 2;
1641 shift = (offset & 3) * 8;
1642 return (s->scratch[n] >> shift) & 0xff;
1643 }
1644 BADF("readb 0x%x\n", offset);
1645 exit(1);
1646 #undef CASE_GET_REG24
1647 #undef CASE_GET_REG32
1648 }
1649
1650 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1651 {
1652 #define CASE_SET_REG24(name, addr) \
1653 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1654 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1655 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1656
1657 #define CASE_SET_REG32(name, addr) \
1658 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1659 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1660 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1661 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1662
1663 #ifdef DEBUG_LSI_REG
1664 DPRINTF("Write reg %x = %02x\n", offset, val);
1665 #endif
1666 switch (offset) {
1667 case 0x00: /* SCNTL0 */
1668 s->scntl0 = val;
1669 if (val & LSI_SCNTL0_START) {
1670 BADF("Start sequence not implemented\n");
1671 }
1672 break;
1673 case 0x01: /* SCNTL1 */
1674 s->scntl1 = val & ~LSI_SCNTL1_SST;
1675 if (val & LSI_SCNTL1_IARB) {
1676 BADF("Immediate Arbritration not implemented\n");
1677 }
1678 if (val & LSI_SCNTL1_RST) {
1679 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1680 DeviceState *dev;
1681
1682 QTAILQ_FOREACH(dev, &s->bus.qbus.children, sibling) {
1683 device_reset(dev);
1684 }
1685 s->sstat0 |= LSI_SSTAT0_RST;
1686 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1687 }
1688 } else {
1689 s->sstat0 &= ~LSI_SSTAT0_RST;
1690 }
1691 break;
1692 case 0x02: /* SCNTL2 */
1693 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1694 s->scntl2 = val;
1695 break;
1696 case 0x03: /* SCNTL3 */
1697 s->scntl3 = val;
1698 break;
1699 case 0x04: /* SCID */
1700 s->scid = val;
1701 break;
1702 case 0x05: /* SXFER */
1703 s->sxfer = val;
1704 break;
1705 case 0x06: /* SDID */
1706 if ((val & 0xf) != (s->ssid & 0xf))
1707 BADF("Destination ID does not match SSID\n");
1708 s->sdid = val & 0xf;
1709 break;
1710 case 0x07: /* GPREG0 */
1711 break;
1712 case 0x08: /* SFBR */
1713 /* The CPU is not allowed to write to this register. However the
1714 SCRIPTS register move instructions are. */
1715 s->sfbr = val;
1716 break;
1717 case 0x0a: case 0x0b:
1718 /* Openserver writes to these readonly registers on startup */
1719 return;
1720 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1721 /* Linux writes to these readonly registers on startup. */
1722 return;
1723 CASE_SET_REG32(dsa, 0x10)
1724 case 0x14: /* ISTAT0 */
1725 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1726 if (val & LSI_ISTAT0_ABRT) {
1727 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1728 }
1729 if (val & LSI_ISTAT0_INTF) {
1730 s->istat0 &= ~LSI_ISTAT0_INTF;
1731 lsi_update_irq(s);
1732 }
1733 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1734 DPRINTF("Woken by SIGP\n");
1735 s->waiting = 0;
1736 s->dsp = s->dnad;
1737 lsi_execute_script(s);
1738 }
1739 if (val & LSI_ISTAT0_SRST) {
1740 lsi_soft_reset(s);
1741 }
1742 break;
1743 case 0x16: /* MBOX0 */
1744 s->mbox0 = val;
1745 break;
1746 case 0x17: /* MBOX1 */
1747 s->mbox1 = val;
1748 break;
1749 case 0x1a: /* CTEST2 */
1750 s->ctest2 = val & LSI_CTEST2_PCICIE;
1751 break;
1752 case 0x1b: /* CTEST3 */
1753 s->ctest3 = val & 0x0f;
1754 break;
1755 CASE_SET_REG32(temp, 0x1c)
1756 case 0x21: /* CTEST4 */
1757 if (val & 7) {
1758 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1759 }
1760 s->ctest4 = val;
1761 break;
1762 case 0x22: /* CTEST5 */
1763 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1764 BADF("CTEST5 DMA increment not implemented\n");
1765 }
1766 s->ctest5 = val;
1767 break;
1768 CASE_SET_REG24(dbc, 0x24)
1769 CASE_SET_REG32(dnad, 0x28)
1770 case 0x2c: /* DSP[0:7] */
1771 s->dsp &= 0xffffff00;
1772 s->dsp |= val;
1773 break;
1774 case 0x2d: /* DSP[8:15] */
1775 s->dsp &= 0xffff00ff;
1776 s->dsp |= val << 8;
1777 break;
1778 case 0x2e: /* DSP[16:23] */
1779 s->dsp &= 0xff00ffff;
1780 s->dsp |= val << 16;
1781 break;
1782 case 0x2f: /* DSP[24:31] */
1783 s->dsp &= 0x00ffffff;
1784 s->dsp |= val << 24;
1785 if ((s->dmode & LSI_DMODE_MAN) == 0
1786 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1787 lsi_execute_script(s);
1788 break;
1789 CASE_SET_REG32(dsps, 0x30)
1790 CASE_SET_REG32(scratch[0], 0x34)
1791 case 0x38: /* DMODE */
1792 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1793 BADF("IO mappings not implemented\n");
1794 }
1795 s->dmode = val;
1796 break;
1797 case 0x39: /* DIEN */
1798 s->dien = val;
1799 lsi_update_irq(s);
1800 break;
1801 case 0x3a: /* SBR */
1802 s->sbr = val;
1803 break;
1804 case 0x3b: /* DCNTL */
1805 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1806 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1807 lsi_execute_script(s);
1808 break;
1809 case 0x40: /* SIEN0 */
1810 s->sien0 = val;
1811 lsi_update_irq(s);
1812 break;
1813 case 0x41: /* SIEN1 */
1814 s->sien1 = val;
1815 lsi_update_irq(s);
1816 break;
1817 case 0x47: /* GPCNTL0 */
1818 break;
1819 case 0x48: /* STIME0 */
1820 s->stime0 = val;
1821 break;
1822 case 0x49: /* STIME1 */
1823 if (val & 0xf) {
1824 DPRINTF("General purpose timer not implemented\n");
1825 /* ??? Raising the interrupt immediately seems to be sufficient
1826 to keep the FreeBSD driver happy. */
1827 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1828 }
1829 break;
1830 case 0x4a: /* RESPID0 */
1831 s->respid0 = val;
1832 break;
1833 case 0x4b: /* RESPID1 */
1834 s->respid1 = val;
1835 break;
1836 case 0x4d: /* STEST1 */
1837 s->stest1 = val;
1838 break;
1839 case 0x4e: /* STEST2 */
1840 if (val & 1) {
1841 BADF("Low level mode not implemented\n");
1842 }
1843 s->stest2 = val;
1844 break;
1845 case 0x4f: /* STEST3 */
1846 if (val & 0x41) {
1847 BADF("SCSI FIFO test mode not implemented\n");
1848 }
1849 s->stest3 = val;
1850 break;
1851 case 0x56: /* CCNTL0 */
1852 s->ccntl0 = val;
1853 break;
1854 case 0x57: /* CCNTL1 */
1855 s->ccntl1 = val;
1856 break;
1857 CASE_SET_REG32(mmrs, 0xa0)
1858 CASE_SET_REG32(mmws, 0xa4)
1859 CASE_SET_REG32(sfs, 0xa8)
1860 CASE_SET_REG32(drs, 0xac)
1861 CASE_SET_REG32(sbms, 0xb0)
1862 CASE_SET_REG32(dbms, 0xb4)
1863 CASE_SET_REG32(dnad64, 0xb8)
1864 CASE_SET_REG32(pmjad1, 0xc0)
1865 CASE_SET_REG32(pmjad2, 0xc4)
1866 CASE_SET_REG32(rbc, 0xc8)
1867 CASE_SET_REG32(ua, 0xcc)
1868 CASE_SET_REG32(ia, 0xd4)
1869 CASE_SET_REG32(sbc, 0xd8)
1870 CASE_SET_REG32(csbc, 0xdc)
1871 default:
1872 if (offset >= 0x5c && offset < 0xa0) {
1873 int n;
1874 int shift;
1875 n = (offset - 0x58) >> 2;
1876 shift = (offset & 3) * 8;
1877 s->scratch[n] &= ~(0xff << shift);
1878 s->scratch[n] |= (val & 0xff) << shift;
1879 } else {
1880 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1881 }
1882 }
1883 #undef CASE_SET_REG24
1884 #undef CASE_SET_REG32
1885 }
1886
1887 static void lsi_mmio_write(void *opaque, target_phys_addr_t addr,
1888 uint64_t val, unsigned size)
1889 {
1890 LSIState *s = opaque;
1891
1892 lsi_reg_writeb(s, addr & 0xff, val);
1893 }
1894
1895 static uint64_t lsi_mmio_read(void *opaque, target_phys_addr_t addr,
1896 unsigned size)
1897 {
1898 LSIState *s = opaque;
1899
1900 return lsi_reg_readb(s, addr & 0xff);
1901 }
1902
1903 static const MemoryRegionOps lsi_mmio_ops = {
1904 .read = lsi_mmio_read,
1905 .write = lsi_mmio_write,
1906 .endianness = DEVICE_NATIVE_ENDIAN,
1907 .impl = {
1908 .min_access_size = 1,
1909 .max_access_size = 1,
1910 },
1911 };
1912
1913 static void lsi_ram_write(void *opaque, target_phys_addr_t addr,
1914 uint64_t val, unsigned size)
1915 {
1916 LSIState *s = opaque;
1917 uint32_t newval;
1918 uint32_t mask;
1919 int shift;
1920
1921 newval = s->script_ram[addr >> 2];
1922 shift = (addr & 3) * 8;
1923 mask = ((uint64_t)1 << (size * 8)) - 1;
1924 newval &= ~(mask << shift);
1925 newval |= val << shift;
1926 s->script_ram[addr >> 2] = newval;
1927 }
1928
1929 static uint64_t lsi_ram_read(void *opaque, target_phys_addr_t addr,
1930 unsigned size)
1931 {
1932 LSIState *s = opaque;
1933 uint32_t val;
1934 uint32_t mask;
1935
1936 val = s->script_ram[addr >> 2];
1937 mask = ((uint64_t)1 << (size * 8)) - 1;
1938 val >>= (addr & 3) * 8;
1939 return val & mask;
1940 }
1941
1942 static const MemoryRegionOps lsi_ram_ops = {
1943 .read = lsi_ram_read,
1944 .write = lsi_ram_write,
1945 .endianness = DEVICE_NATIVE_ENDIAN,
1946 };
1947
1948 static uint64_t lsi_io_read(void *opaque, target_phys_addr_t addr,
1949 unsigned size)
1950 {
1951 LSIState *s = opaque;
1952 return lsi_reg_readb(s, addr & 0xff);
1953 }
1954
1955 static void lsi_io_write(void *opaque, target_phys_addr_t addr,
1956 uint64_t val, unsigned size)
1957 {
1958 LSIState *s = opaque;
1959 lsi_reg_writeb(s, addr & 0xff, val);
1960 }
1961
1962 static const MemoryRegionOps lsi_io_ops = {
1963 .read = lsi_io_read,
1964 .write = lsi_io_write,
1965 .endianness = DEVICE_NATIVE_ENDIAN,
1966 .impl = {
1967 .min_access_size = 1,
1968 .max_access_size = 1,
1969 },
1970 };
1971
1972 static void lsi_scsi_reset(DeviceState *dev)
1973 {
1974 LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
1975
1976 lsi_soft_reset(s);
1977 }
1978
1979 static void lsi_pre_save(void *opaque)
1980 {
1981 LSIState *s = opaque;
1982
1983 if (s->current) {
1984 assert(s->current->dma_buf == NULL);
1985 assert(s->current->dma_len == 0);
1986 }
1987 assert(QTAILQ_EMPTY(&s->queue));
1988 }
1989
1990 static const VMStateDescription vmstate_lsi_scsi = {
1991 .name = "lsiscsi",
1992 .version_id = 0,
1993 .minimum_version_id = 0,
1994 .minimum_version_id_old = 0,
1995 .pre_save = lsi_pre_save,
1996 .fields = (VMStateField []) {
1997 VMSTATE_PCI_DEVICE(dev, LSIState),
1998
1999 VMSTATE_INT32(carry, LSIState),
2000 VMSTATE_INT32(status, LSIState),
2001 VMSTATE_INT32(msg_action, LSIState),
2002 VMSTATE_INT32(msg_len, LSIState),
2003 VMSTATE_BUFFER(msg, LSIState),
2004 VMSTATE_INT32(waiting, LSIState),
2005
2006 VMSTATE_UINT32(dsa, LSIState),
2007 VMSTATE_UINT32(temp, LSIState),
2008 VMSTATE_UINT32(dnad, LSIState),
2009 VMSTATE_UINT32(dbc, LSIState),
2010 VMSTATE_UINT8(istat0, LSIState),
2011 VMSTATE_UINT8(istat1, LSIState),
2012 VMSTATE_UINT8(dcmd, LSIState),
2013 VMSTATE_UINT8(dstat, LSIState),
2014 VMSTATE_UINT8(dien, LSIState),
2015 VMSTATE_UINT8(sist0, LSIState),
2016 VMSTATE_UINT8(sist1, LSIState),
2017 VMSTATE_UINT8(sien0, LSIState),
2018 VMSTATE_UINT8(sien1, LSIState),
2019 VMSTATE_UINT8(mbox0, LSIState),
2020 VMSTATE_UINT8(mbox1, LSIState),
2021 VMSTATE_UINT8(dfifo, LSIState),
2022 VMSTATE_UINT8(ctest2, LSIState),
2023 VMSTATE_UINT8(ctest3, LSIState),
2024 VMSTATE_UINT8(ctest4, LSIState),
2025 VMSTATE_UINT8(ctest5, LSIState),
2026 VMSTATE_UINT8(ccntl0, LSIState),
2027 VMSTATE_UINT8(ccntl1, LSIState),
2028 VMSTATE_UINT32(dsp, LSIState),
2029 VMSTATE_UINT32(dsps, LSIState),
2030 VMSTATE_UINT8(dmode, LSIState),
2031 VMSTATE_UINT8(dcntl, LSIState),
2032 VMSTATE_UINT8(scntl0, LSIState),
2033 VMSTATE_UINT8(scntl1, LSIState),
2034 VMSTATE_UINT8(scntl2, LSIState),
2035 VMSTATE_UINT8(scntl3, LSIState),
2036 VMSTATE_UINT8(sstat0, LSIState),
2037 VMSTATE_UINT8(sstat1, LSIState),
2038 VMSTATE_UINT8(scid, LSIState),
2039 VMSTATE_UINT8(sxfer, LSIState),
2040 VMSTATE_UINT8(socl, LSIState),
2041 VMSTATE_UINT8(sdid, LSIState),
2042 VMSTATE_UINT8(ssid, LSIState),
2043 VMSTATE_UINT8(sfbr, LSIState),
2044 VMSTATE_UINT8(stest1, LSIState),
2045 VMSTATE_UINT8(stest2, LSIState),
2046 VMSTATE_UINT8(stest3, LSIState),
2047 VMSTATE_UINT8(sidl, LSIState),
2048 VMSTATE_UINT8(stime0, LSIState),
2049 VMSTATE_UINT8(respid0, LSIState),
2050 VMSTATE_UINT8(respid1, LSIState),
2051 VMSTATE_UINT32(mmrs, LSIState),
2052 VMSTATE_UINT32(mmws, LSIState),
2053 VMSTATE_UINT32(sfs, LSIState),
2054 VMSTATE_UINT32(drs, LSIState),
2055 VMSTATE_UINT32(sbms, LSIState),
2056 VMSTATE_UINT32(dbms, LSIState),
2057 VMSTATE_UINT32(dnad64, LSIState),
2058 VMSTATE_UINT32(pmjad1, LSIState),
2059 VMSTATE_UINT32(pmjad2, LSIState),
2060 VMSTATE_UINT32(rbc, LSIState),
2061 VMSTATE_UINT32(ua, LSIState),
2062 VMSTATE_UINT32(ia, LSIState),
2063 VMSTATE_UINT32(sbc, LSIState),
2064 VMSTATE_UINT32(csbc, LSIState),
2065 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2066 VMSTATE_UINT8(sbr, LSIState),
2067
2068 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2069 VMSTATE_END_OF_LIST()
2070 }
2071 };
2072
2073 static void lsi_scsi_uninit(PCIDevice *d)
2074 {
2075 LSIState *s = DO_UPCAST(LSIState, dev, d);
2076
2077 memory_region_destroy(&s->mmio_io);
2078 memory_region_destroy(&s->ram_io);
2079 memory_region_destroy(&s->io_io);
2080 }
2081
2082 static const struct SCSIBusInfo lsi_scsi_info = {
2083 .tcq = true,
2084 .max_target = LSI_MAX_DEVS,
2085 .max_lun = 0, /* LUN support is buggy */
2086
2087 .transfer_data = lsi_transfer_data,
2088 .complete = lsi_command_complete,
2089 .cancel = lsi_request_cancelled
2090 };
2091
2092 static int lsi_scsi_init(PCIDevice *dev)
2093 {
2094 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2095 uint8_t *pci_conf;
2096
2097 pci_conf = s->dev.config;
2098
2099 /* PCI latency timer = 255 */
2100 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2101 /* Interrupt pin A */
2102 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2103
2104 memory_region_init_io(&s->mmio_io, &lsi_mmio_ops, s, "lsi-mmio", 0x400);
2105 memory_region_init_io(&s->ram_io, &lsi_ram_ops, s, "lsi-ram", 0x2000);
2106 memory_region_init_io(&s->io_io, &lsi_io_ops, s, "lsi-io", 256);
2107
2108 pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2109 pci_register_bar(&s->dev, 1, 0, &s->mmio_io);
2110 pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
2111 QTAILQ_INIT(&s->queue);
2112
2113 scsi_bus_new(&s->bus, &dev->qdev, &lsi_scsi_info);
2114 if (!dev->qdev.hotplugged) {
2115 return scsi_bus_legacy_handle_cmdline(&s->bus);
2116 }
2117 return 0;
2118 }
2119
2120 static void lsi_class_init(ObjectClass *klass, void *data)
2121 {
2122 DeviceClass *dc = DEVICE_CLASS(klass);
2123 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2124
2125 k->init = lsi_scsi_init;
2126 k->exit = lsi_scsi_uninit;
2127 k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2128 k->device_id = PCI_DEVICE_ID_LSI_53C895A;
2129 k->class_id = PCI_CLASS_STORAGE_SCSI;
2130 k->subsystem_id = 0x1000;
2131 dc->reset = lsi_scsi_reset;
2132 dc->vmsd = &vmstate_lsi_scsi;
2133 }
2134
2135 static TypeInfo lsi_info = {
2136 .name = "lsi53c895a",
2137 .parent = TYPE_PCI_DEVICE,
2138 .instance_size = sizeof(LSIState),
2139 .class_init = lsi_class_init,
2140 };
2141
2142 static void lsi53c895a_register_types(void)
2143 {
2144 type_register_static(&lsi_info);
2145 }
2146
2147 type_init(lsi53c895a_register_types)
QEMU mirror