?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-migration-20210726a...
[qemu/armbru.git] / hw / scsi / lsi53c895a.c
blobe2c19180a0da785d84ccc04f3febbd615ae41c37
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licensed under the LGPL.
8 */
9
10 /* Note:
11 * LSI53C810 emulation is incorrect, in the sense that it supports
12 * features added in later evolutions. This should not be a problem,
13 * as well-behaved operating systems will not try to use them.
14 */
15
16 #include "qemu/osdep.h"
17
18 #include "hw/irq.h"
19 #include "hw/pci/pci.h"
20 #include "hw/scsi/scsi.h"
21 #include "migration/vmstate.h"
22 #include "sysemu/dma.h"
23 #include "qemu/log.h"
24 #include "qemu/module.h"
25 #include "trace.h"
26 #include "qom/object.h"
27
28 static const char *names[] = {
29 "SCNTL0", "SCNTL1", "SCNTL2", "SCNTL3", "SCID", "SXFER", "SDID", "GPREG",
30 "SFBR", "SOCL", "SSID", "SBCL", "DSTAT", "SSTAT0", "SSTAT1", "SSTAT2",
31 "DSA0", "DSA1", "DSA2", "DSA3", "ISTAT", "0x15", "0x16", "0x17",
32 "CTEST0", "CTEST1", "CTEST2", "CTEST3", "TEMP0", "TEMP1", "TEMP2", "TEMP3",
33 "DFIFO", "CTEST4", "CTEST5", "CTEST6", "DBC0", "DBC1", "DBC2", "DCMD",
34 "DNAD0", "DNAD1", "DNAD2", "DNAD3", "DSP0", "DSP1", "DSP2", "DSP3",
35 "DSPS0", "DSPS1", "DSPS2", "DSPS3", "SCRATCHA0", "SCRATCHA1", "SCRATCHA2", "SCRATCHA3",
36 "DMODE", "DIEN", "SBR", "DCNTL", "ADDER0", "ADDER1", "ADDER2", "ADDER3",
37 "SIEN0", "SIEN1", "SIST0", "SIST1", "SLPAR", "0x45", "MACNTL", "GPCNTL",
38 "STIME0", "STIME1", "RESPID", "0x4b", "STEST0", "STEST1", "STEST2", "STEST3",
39 "SIDL", "0x51", "0x52", "0x53", "SODL", "0x55", "0x56", "0x57",
40 "SBDL", "0x59", "0x5a", "0x5b", "SCRATCHB0", "SCRATCHB1", "SCRATCHB2", "SCRATCHB3",
41 };
42
43 #define LSI_MAX_DEVS 7
44
45 #define LSI_SCNTL0_TRG 0x01
46 #define LSI_SCNTL0_AAP 0x02
47 #define LSI_SCNTL0_EPC 0x08
48 #define LSI_SCNTL0_WATN 0x10
49 #define LSI_SCNTL0_START 0x20
50
51 #define LSI_SCNTL1_SST 0x01
52 #define LSI_SCNTL1_IARB 0x02
53 #define LSI_SCNTL1_AESP 0x04
54 #define LSI_SCNTL1_RST 0x08
55 #define LSI_SCNTL1_CON 0x10
56 #define LSI_SCNTL1_DHP 0x20
57 #define LSI_SCNTL1_ADB 0x40
58 #define LSI_SCNTL1_EXC 0x80
59
60 #define LSI_SCNTL2_WSR 0x01
61 #define LSI_SCNTL2_VUE0 0x02
62 #define LSI_SCNTL2_VUE1 0x04
63 #define LSI_SCNTL2_WSS 0x08
64 #define LSI_SCNTL2_SLPHBEN 0x10
65 #define LSI_SCNTL2_SLPMD 0x20
66 #define LSI_SCNTL2_CHM 0x40
67 #define LSI_SCNTL2_SDU 0x80
68
69 #define LSI_ISTAT0_DIP 0x01
70 #define LSI_ISTAT0_SIP 0x02
71 #define LSI_ISTAT0_INTF 0x04
72 #define LSI_ISTAT0_CON 0x08
73 #define LSI_ISTAT0_SEM 0x10
74 #define LSI_ISTAT0_SIGP 0x20
75 #define LSI_ISTAT0_SRST 0x40
76 #define LSI_ISTAT0_ABRT 0x80
77
78 #define LSI_ISTAT1_SI 0x01
79 #define LSI_ISTAT1_SRUN 0x02
80 #define LSI_ISTAT1_FLSH 0x04
81
82 #define LSI_SSTAT0_SDP0 0x01
83 #define LSI_SSTAT0_RST 0x02
84 #define LSI_SSTAT0_WOA 0x04
85 #define LSI_SSTAT0_LOA 0x08
86 #define LSI_SSTAT0_AIP 0x10
87 #define LSI_SSTAT0_OLF 0x20
88 #define LSI_SSTAT0_ORF 0x40
89 #define LSI_SSTAT0_ILF 0x80
90
91 #define LSI_SIST0_PAR 0x01
92 #define LSI_SIST0_RST 0x02
93 #define LSI_SIST0_UDC 0x04
94 #define LSI_SIST0_SGE 0x08
95 #define LSI_SIST0_RSL 0x10
96 #define LSI_SIST0_SEL 0x20
97 #define LSI_SIST0_CMP 0x40
98 #define LSI_SIST0_MA 0x80
99
100 #define LSI_SIST1_HTH 0x01
101 #define LSI_SIST1_GEN 0x02
102 #define LSI_SIST1_STO 0x04
103 #define LSI_SIST1_SBMC 0x10
104
105 #define LSI_SOCL_IO 0x01
106 #define LSI_SOCL_CD 0x02
107 #define LSI_SOCL_MSG 0x04
108 #define LSI_SOCL_ATN 0x08
109 #define LSI_SOCL_SEL 0x10
110 #define LSI_SOCL_BSY 0x20
111 #define LSI_SOCL_ACK 0x40
112 #define LSI_SOCL_REQ 0x80
113
114 #define LSI_DSTAT_IID 0x01
115 #define LSI_DSTAT_SIR 0x04
116 #define LSI_DSTAT_SSI 0x08
117 #define LSI_DSTAT_ABRT 0x10
118 #define LSI_DSTAT_BF 0x20
119 #define LSI_DSTAT_MDPE 0x40
120 #define LSI_DSTAT_DFE 0x80
121
122 #define LSI_DCNTL_COM 0x01
123 #define LSI_DCNTL_IRQD 0x02
124 #define LSI_DCNTL_STD 0x04
125 #define LSI_DCNTL_IRQM 0x08
126 #define LSI_DCNTL_SSM 0x10
127 #define LSI_DCNTL_PFEN 0x20
128 #define LSI_DCNTL_PFF 0x40
129 #define LSI_DCNTL_CLSE 0x80
130
131 #define LSI_DMODE_MAN 0x01
132 #define LSI_DMODE_BOF 0x02
133 #define LSI_DMODE_ERMP 0x04
134 #define LSI_DMODE_ERL 0x08
135 #define LSI_DMODE_DIOM 0x10
136 #define LSI_DMODE_SIOM 0x20
137
138 #define LSI_CTEST2_DACK 0x01
139 #define LSI_CTEST2_DREQ 0x02
140 #define LSI_CTEST2_TEOP 0x04
141 #define LSI_CTEST2_PCICIE 0x08
142 #define LSI_CTEST2_CM 0x10
143 #define LSI_CTEST2_CIO 0x20
144 #define LSI_CTEST2_SIGP 0x40
145 #define LSI_CTEST2_DDIR 0x80
146
147 #define LSI_CTEST5_BL2 0x04
148 #define LSI_CTEST5_DDIR 0x08
149 #define LSI_CTEST5_MASR 0x10
150 #define LSI_CTEST5_DFSN 0x20
151 #define LSI_CTEST5_BBCK 0x40
152 #define LSI_CTEST5_ADCK 0x80
153
154 #define LSI_CCNTL0_DILS 0x01
155 #define LSI_CCNTL0_DISFC 0x10
156 #define LSI_CCNTL0_ENNDJ 0x20
157 #define LSI_CCNTL0_PMJCTL 0x40
158 #define LSI_CCNTL0_ENPMJ 0x80
159
160 #define LSI_CCNTL1_EN64DBMV 0x01
161 #define LSI_CCNTL1_EN64TIBMV 0x02
162 #define LSI_CCNTL1_64TIMOD 0x04
163 #define LSI_CCNTL1_DDAC 0x08
164 #define LSI_CCNTL1_ZMOD 0x80
165
166 #define LSI_SBCL_ATN 0x08
167 #define LSI_SBCL_BSY 0x20
168 #define LSI_SBCL_ACK 0x40
169 #define LSI_SBCL_REQ 0x80
170
171 /* Enable Response to Reselection */
172 #define LSI_SCID_RRE 0x60
173
174 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
175
176 #define PHASE_DO 0
177 #define PHASE_DI 1
178 #define PHASE_CMD 2
179 #define PHASE_ST 3
180 #define PHASE_MO 6
181 #define PHASE_MI 7
182 #define PHASE_MASK 7
183
184 /* Maximum length of MSG IN data. */
185 #define LSI_MAX_MSGIN_LEN 8
186
187 /* Flag set if this is a tagged command. */
188 #define LSI_TAG_VALID (1 << 16)
189
190 /* Maximum instructions to process. */
191 #define LSI_MAX_INSN 10000
192
193 typedef struct lsi_request {
194 SCSIRequest *req;
195 uint32_t tag;
196 uint32_t dma_len;
197 uint8_t *dma_buf;
198 uint32_t pending;
199 int out;
200 QTAILQ_ENTRY(lsi_request) next;
201 } lsi_request;
202
203 enum {
204 LSI_NOWAIT, /* SCRIPTS are running or stopped */
205 LSI_WAIT_RESELECT, /* Wait Reselect instruction has been issued */
206 LSI_DMA_SCRIPTS, /* processing DMA from lsi_execute_script */
207 LSI_DMA_IN_PROGRESS, /* DMA operation is in progress */
208 };
209
210 enum {
211 LSI_MSG_ACTION_COMMAND = 0,
212 LSI_MSG_ACTION_DISCONNECT = 1,
213 LSI_MSG_ACTION_DOUT = 2,
214 LSI_MSG_ACTION_DIN = 3,
215 };
216
217 struct LSIState {
218 /*< private >*/
219 PCIDevice parent_obj;
220 /*< public >*/
221
222 qemu_irq ext_irq;
223 MemoryRegion mmio_io;
224 MemoryRegion ram_io;
225 MemoryRegion io_io;
226 AddressSpace pci_io_as;
227
228 int carry; /* ??? Should this be an a visible register somewhere? */
229 int status;
230 int msg_action;
231 int msg_len;
232 uint8_t msg[LSI_MAX_MSGIN_LEN];
233 int waiting;
234 SCSIBus bus;
235 int current_lun;
236 /* The tag is a combination of the device ID and the SCSI tag. */
237 uint32_t select_tag;
238 int command_complete;
239 QTAILQ_HEAD(, lsi_request) queue;
240 lsi_request *current;
241
242 uint32_t dsa;
243 uint32_t temp;
244 uint32_t dnad;
245 uint32_t dbc;
246 uint8_t istat0;
247 uint8_t istat1;
248 uint8_t dcmd;
249 uint8_t dstat;
250 uint8_t dien;
251 uint8_t sist0;
252 uint8_t sist1;
253 uint8_t sien0;
254 uint8_t sien1;
255 uint8_t mbox0;
256 uint8_t mbox1;
257 uint8_t dfifo;
258 uint8_t ctest2;
259 uint8_t ctest3;
260 uint8_t ctest4;
261 uint8_t ctest5;
262 uint8_t ccntl0;
263 uint8_t ccntl1;
264 uint32_t dsp;
265 uint32_t dsps;
266 uint8_t dmode;
267 uint8_t dcntl;
268 uint8_t scntl0;
269 uint8_t scntl1;
270 uint8_t scntl2;
271 uint8_t scntl3;
272 uint8_t sstat0;
273 uint8_t sstat1;
274 uint8_t scid;
275 uint8_t sxfer;
276 uint8_t socl;
277 uint8_t sdid;
278 uint8_t ssid;
279 uint8_t sfbr;
280 uint8_t sbcl;
281 uint8_t stest1;
282 uint8_t stest2;
283 uint8_t stest3;
284 uint8_t sidl;
285 uint8_t stime0;
286 uint8_t respid0;
287 uint8_t respid1;
288 uint32_t mmrs;
289 uint32_t mmws;
290 uint32_t sfs;
291 uint32_t drs;
292 uint32_t sbms;
293 uint32_t dbms;
294 uint32_t dnad64;
295 uint32_t pmjad1;
296 uint32_t pmjad2;
297 uint32_t rbc;
298 uint32_t ua;
299 uint32_t ia;
300 uint32_t sbc;
301 uint32_t csbc;
302 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
303 uint8_t sbr;
304 uint32_t adder;
305
306 uint8_t script_ram[2048 * sizeof(uint32_t)];
307 };
308
309 #define TYPE_LSI53C810 "lsi53c810"
310 #define TYPE_LSI53C895A "lsi53c895a"
311
312 OBJECT_DECLARE_SIMPLE_TYPE(LSIState, LSI53C895A)
313
314 static const char *scsi_phases[] = {
315 "DOUT",
316 "DIN",
317 "CMD",
318 "STATUS",
319 "RSVOUT",
320 "RSVIN",
321 "MSGOUT",
322 "MSGIN"
323 };
324
325 static const char *scsi_phase_name(int phase)
326 {
327 return scsi_phases[phase & PHASE_MASK];
328 }
329
330 static inline int lsi_irq_on_rsl(LSIState *s)
331 {
332 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
333 }
334
335 static lsi_request *get_pending_req(LSIState *s)
336 {
337 lsi_request *p;
338
339 QTAILQ_FOREACH(p, &s->queue, next) {
340 if (p->pending) {
341 return p;
342 }
343 }
344 return NULL;
345 }
346
347 static void lsi_soft_reset(LSIState *s)
348 {
349 trace_lsi_reset();
350 s->carry = 0;
351
352 s->msg_action = LSI_MSG_ACTION_COMMAND;
353 s->msg_len = 0;
354 s->waiting = LSI_NOWAIT;
355 s->dsa = 0;
356 s->dnad = 0;
357 s->dbc = 0;
358 s->temp = 0;
359 memset(s->scratch, 0, sizeof(s->scratch));
360 s->istat0 = 0;
361 s->istat1 = 0;
362 s->dcmd = 0x40;
363 s->dstat = 0;
364 s->dien = 0;
365 s->sist0 = 0;
366 s->sist1 = 0;
367 s->sien0 = 0;
368 s->sien1 = 0;
369 s->mbox0 = 0;
370 s->mbox1 = 0;
371 s->dfifo = 0;
372 s->ctest2 = LSI_CTEST2_DACK;
373 s->ctest3 = 0;
374 s->ctest4 = 0;
375 s->ctest5 = 0;
376 s->ccntl0 = 0;
377 s->ccntl1 = 0;
378 s->dsp = 0;
379 s->dsps = 0;
380 s->dmode = 0;
381 s->dcntl = 0;
382 s->scntl0 = 0xc0;
383 s->scntl1 = 0;
384 s->scntl2 = 0;
385 s->scntl3 = 0;
386 s->sstat0 = 0;
387 s->sstat1 = 0;
388 s->scid = 7;
389 s->sxfer = 0;
390 s->socl = 0;
391 s->sdid = 0;
392 s->ssid = 0;
393 s->sbcl = 0;
394 s->stest1 = 0;
395 s->stest2 = 0;
396 s->stest3 = 0;
397 s->sidl = 0;
398 s->stime0 = 0;
399 s->respid0 = 0x80;
400 s->respid1 = 0;
401 s->mmrs = 0;
402 s->mmws = 0;
403 s->sfs = 0;
404 s->drs = 0;
405 s->sbms = 0;
406 s->dbms = 0;
407 s->dnad64 = 0;
408 s->pmjad1 = 0;
409 s->pmjad2 = 0;
410 s->rbc = 0;
411 s->ua = 0;
412 s->ia = 0;
413 s->sbc = 0;
414 s->csbc = 0;
415 s->sbr = 0;
416 assert(QTAILQ_EMPTY(&s->queue));
417 assert(!s->current);
418 }
419
420 static int lsi_dma_40bit(LSIState *s)
421 {
422 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
423 return 1;
424 return 0;
425 }
426
427 static int lsi_dma_ti64bit(LSIState *s)
428 {
429 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
430 return 1;
431 return 0;
432 }
433
434 static int lsi_dma_64bit(LSIState *s)
435 {
436 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
437 return 1;
438 return 0;
439 }
440
441 static uint8_t lsi_reg_readb(LSIState *s, int offset);
442 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
443 static void lsi_execute_script(LSIState *s);
444 static void lsi_reselect(LSIState *s, lsi_request *p);
445
446 static inline void lsi_mem_read(LSIState *s, dma_addr_t addr,
447 void *buf, dma_addr_t len)
448 {
449 if (s->dmode & LSI_DMODE_SIOM) {
450 address_space_read(&s->pci_io_as, addr, MEMTXATTRS_UNSPECIFIED,
451 buf, len);
452 } else {
453 pci_dma_read(PCI_DEVICE(s), addr, buf, len);
454 }
455 }
456
457 static inline void lsi_mem_write(LSIState *s, dma_addr_t addr,
458 const void *buf, dma_addr_t len)
459 {
460 if (s->dmode & LSI_DMODE_DIOM) {
461 address_space_write(&s->pci_io_as, addr, MEMTXATTRS_UNSPECIFIED,
462 buf, len);
463 } else {
464 pci_dma_write(PCI_DEVICE(s), addr, buf, len);
465 }
466 }
467
468 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
469 {
470 uint32_t buf;
471
472 pci_dma_read(PCI_DEVICE(s), addr, &buf, 4);
473 return cpu_to_le32(buf);
474 }
475
476 static void lsi_stop_script(LSIState *s)
477 {
478 s->istat1 &= ~LSI_ISTAT1_SRUN;
479 }
480
481 static void lsi_set_irq(LSIState *s, int level)
482 {
483 PCIDevice *d = PCI_DEVICE(s);
484
485 if (s->ext_irq) {
486 qemu_set_irq(s->ext_irq, level);
487 } else {
488 pci_set_irq(d, level);
489 }
490 }
491
492 static void lsi_update_irq(LSIState *s)
493 {
494 int level;
495 static int last_level;
496
497 /* It's unclear whether the DIP/SIP bits should be cleared when the
498 Interrupt Status Registers are cleared or when istat0 is read.
499 We currently do the formwer, which seems to work. */
500 level = 0;
501 if (s->dstat) {
502 if (s->dstat & s->dien)
503 level = 1;
504 s->istat0 |= LSI_ISTAT0_DIP;
505 } else {
506 s->istat0 &= ~LSI_ISTAT0_DIP;
507 }
508
509 if (s->sist0 || s->sist1) {
510 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
511 level = 1;
512 s->istat0 |= LSI_ISTAT0_SIP;
513 } else {
514 s->istat0 &= ~LSI_ISTAT0_SIP;
515 }
516 if (s->istat0 & LSI_ISTAT0_INTF)
517 level = 1;
518
519 if (level != last_level) {
520 trace_lsi_update_irq(level, s->dstat, s->sist1, s->sist0);
521 last_level = level;
522 }
523 lsi_set_irq(s, level);
524
525 if (!s->current && !level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
526 lsi_request *p;
527
528 trace_lsi_update_irq_disconnected();
529 p = get_pending_req(s);
530 if (p) {
531 lsi_reselect(s, p);
532 }
533 }
534 }
535
536 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
537 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
538 {
539 uint32_t mask0;
540 uint32_t mask1;
541
542 trace_lsi_script_scsi_interrupt(stat1, stat0, s->sist1, s->sist0);
543 s->sist0 |= stat0;
544 s->sist1 |= stat1;
545 /* Stop processor on fatal or unmasked interrupt. As a special hack
546 we don't stop processing when raising STO. Instead continue
547 execution and stop at the next insn that accesses the SCSI bus. */
548 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
549 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
550 mask1 &= ~LSI_SIST1_STO;
551 if (s->sist0 & mask0 || s->sist1 & mask1) {
552 lsi_stop_script(s);
553 }
554 lsi_update_irq(s);
555 }
556
557 /* Stop SCRIPTS execution and raise a DMA interrupt. */
558 static void lsi_script_dma_interrupt(LSIState *s, int stat)
559 {
560 trace_lsi_script_dma_interrupt(stat, s->dstat);
561 s->dstat |= stat;
562 lsi_update_irq(s);
563 lsi_stop_script(s);
564 }
565
566 static inline void lsi_set_phase(LSIState *s, int phase)
567 {
568 s->sbcl &= ~PHASE_MASK;
569 s->sbcl |= phase | LSI_SBCL_REQ;
570 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
571 }
572
573 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
574 {
575 /* Trigger a phase mismatch. */
576 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
577 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
578 s->dsp = out ? s->pmjad1 : s->pmjad2;
579 } else {
580 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
581 }
582 trace_lsi_bad_phase_jump(s->dsp);
583 } else {
584 trace_lsi_bad_phase_interrupt();
585 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
586 lsi_stop_script(s);
587 }
588 lsi_set_phase(s, new_phase);
589 }
590
591
592 /* Resume SCRIPTS execution after a DMA operation. */
593 static void lsi_resume_script(LSIState *s)
594 {
595 if (s->waiting != 2) {
596 s->waiting = LSI_NOWAIT;
597 lsi_execute_script(s);
598 } else {
599 s->waiting = LSI_NOWAIT;
600 }
601 }
602
603 static void lsi_disconnect(LSIState *s)
604 {
605 s->scntl1 &= ~LSI_SCNTL1_CON;
606 s->sstat1 &= ~PHASE_MASK;
607 s->sbcl = 0;
608 }
609
610 static void lsi_bad_selection(LSIState *s, uint32_t id)
611 {
612 trace_lsi_bad_selection(id);
613 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
614 lsi_disconnect(s);
615 }
616
617 /* Initiate a SCSI layer data transfer. */
618 static void lsi_do_dma(LSIState *s, int out)
619 {
620 uint32_t count;
621 dma_addr_t addr;
622 SCSIDevice *dev;
623
624 assert(s->current);
625 if (!s->current->dma_len) {
626 /* Wait until data is available. */
627 trace_lsi_do_dma_unavailable();
628 return;
629 }
630
631 dev = s->current->req->dev;
632 assert(dev);
633
634 count = s->dbc;
635 if (count > s->current->dma_len)
636 count = s->current->dma_len;
637
638 addr = s->dnad;
639 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
640 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
641 addr |= ((uint64_t)s->dnad64 << 32);
642 else if (s->dbms)
643 addr |= ((uint64_t)s->dbms << 32);
644 else if (s->sbms)
645 addr |= ((uint64_t)s->sbms << 32);
646
647 trace_lsi_do_dma(addr, count);
648 s->csbc += count;
649 s->dnad += count;
650 s->dbc -= count;
651 if (s->current->dma_buf == NULL) {
652 s->current->dma_buf = scsi_req_get_buf(s->current->req);
653 }
654 /* ??? Set SFBR to first data byte. */
655 if (out) {
656 lsi_mem_read(s, addr, s->current->dma_buf, count);
657 } else {
658 lsi_mem_write(s, addr, s->current->dma_buf, count);
659 }
660 s->current->dma_len -= count;
661 if (s->current->dma_len == 0) {
662 s->current->dma_buf = NULL;
663 scsi_req_continue(s->current->req);
664 } else {
665 s->current->dma_buf += count;
666 lsi_resume_script(s);
667 }
668 }
669
670
671 /* Add a command to the queue. */
672 static void lsi_queue_command(LSIState *s)
673 {
674 lsi_request *p = s->current;
675
676 trace_lsi_queue_command(p->tag);
677 assert(s->current != NULL);
678 assert(s->current->dma_len == 0);
679 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
680 s->current = NULL;
681
682 p->pending = 0;
683 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
684 }
685
686 /* Queue a byte for a MSG IN phase. */
687 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
688 {
689 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
690 trace_lsi_add_msg_byte_error();
691 } else {
692 trace_lsi_add_msg_byte(data);
693 s->msg[s->msg_len++] = data;
694 }
695 }
696
697 /* Perform reselection to continue a command. */
698 static void lsi_reselect(LSIState *s, lsi_request *p)
699 {
700 int id;
701
702 assert(s->current == NULL);
703 QTAILQ_REMOVE(&s->queue, p, next);
704 s->current = p;
705
706 id = (p->tag >> 8) & 0xf;
707 s->ssid = id | 0x80;
708 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
709 if (!(s->dcntl & LSI_DCNTL_COM)) {
710 s->sfbr = 1 << (id & 0x7);
711 }
712 trace_lsi_reselect(id);
713 s->scntl1 |= LSI_SCNTL1_CON;
714 lsi_set_phase(s, PHASE_MI);
715 s->msg_action = p->out ? LSI_MSG_ACTION_DOUT : LSI_MSG_ACTION_DIN;
716 s->current->dma_len = p->pending;
717 lsi_add_msg_byte(s, 0x80);
718 if (s->current->tag & LSI_TAG_VALID) {
719 lsi_add_msg_byte(s, 0x20);
720 lsi_add_msg_byte(s, p->tag & 0xff);
721 }
722
723 if (lsi_irq_on_rsl(s)) {
724 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
725 }
726 }
727
728 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
729 {
730 lsi_request *p;
731
732 QTAILQ_FOREACH(p, &s->queue, next) {
733 if (p->tag == tag) {
734 return p;
735 }
736 }
737
738 return NULL;
739 }
740
741 static void lsi_request_free(LSIState *s, lsi_request *p)
742 {
743 if (p == s->current) {
744 s->current = NULL;
745 } else {
746 QTAILQ_REMOVE(&s->queue, p, next);
747 }
748 g_free(p);
749 }
750
751 static void lsi_request_cancelled(SCSIRequest *req)
752 {
753 LSIState *s = LSI53C895A(req->bus->qbus.parent);
754 lsi_request *p = req->hba_private;
755
756 req->hba_private = NULL;
757 lsi_request_free(s, p);
758 scsi_req_unref(req);
759 }
760
761 /* Record that data is available for a queued command. Returns zero if
762 the device was reselected, nonzero if the IO is deferred. */
763 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
764 {
765 lsi_request *p = req->hba_private;
766
767 if (p->pending) {
768 trace_lsi_queue_req_error(p);
769 }
770 p->pending = len;
771 /* Reselect if waiting for it, or if reselection triggers an IRQ
772 and the bus is free.
773 Since no interrupt stacking is implemented in the emulation, it
774 is also required that there are no pending interrupts waiting
775 for service from the device driver. */
776 if (s->waiting == LSI_WAIT_RESELECT ||
777 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
778 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
779 /* Reselect device. */
780 lsi_reselect(s, p);
781 return 0;
782 } else {
783 trace_lsi_queue_req(p->tag);
784 p->pending = len;
785 return 1;
786 }
787 }
788
789 /* Callback to indicate that the SCSI layer has completed a command. */
790 static void lsi_command_complete(SCSIRequest *req, size_t resid)
791 {
792 LSIState *s = LSI53C895A(req->bus->qbus.parent);
793 int out;
794
795 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
796 trace_lsi_command_complete(req->status);
797 s->status = req->status;
798 s->command_complete = 2;
799 if (s->waiting && s->dbc != 0) {
800 /* Raise phase mismatch for short transfers. */
801 lsi_bad_phase(s, out, PHASE_ST);
802 } else {
803 lsi_set_phase(s, PHASE_ST);
804 }
805
806 if (req->hba_private == s->current) {
807 req->hba_private = NULL;
808 lsi_request_free(s, s->current);
809 scsi_req_unref(req);
810 }
811 lsi_resume_script(s);
812 }
813
814 /* Callback to indicate that the SCSI layer has completed a transfer. */
815 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
816 {
817 LSIState *s = LSI53C895A(req->bus->qbus.parent);
818 int out;
819
820 assert(req->hba_private);
821 if (s->waiting == LSI_WAIT_RESELECT || req->hba_private != s->current ||
822 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
823 if (lsi_queue_req(s, req, len)) {
824 return;
825 }
826 }
827
828 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
829
830 /* host adapter (re)connected */
831 trace_lsi_transfer_data(req->tag, len);
832 s->current->dma_len = len;
833 s->command_complete = 1;
834 if (s->waiting) {
835 if (s->waiting == LSI_WAIT_RESELECT || s->dbc == 0) {
836 lsi_resume_script(s);
837 } else {
838 lsi_do_dma(s, out);
839 }
840 }
841 }
842
843 static void lsi_do_command(LSIState *s)
844 {
845 SCSIDevice *dev;
846 uint8_t buf[16];
847 uint32_t id;
848 int n;
849
850 trace_lsi_do_command(s->dbc);
851 if (s->dbc > 16)
852 s->dbc = 16;
853 pci_dma_read(PCI_DEVICE(s), s->dnad, buf, s->dbc);
854 s->sfbr = buf[0];
855 s->command_complete = 0;
856
857 id = (s->select_tag >> 8) & 0xf;
858 dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
859 if (!dev) {
860 lsi_bad_selection(s, id);
861 return;
862 }
863
864 assert(s->current == NULL);
865 s->current = g_new0(lsi_request, 1);
866 s->current->tag = s->select_tag;
867 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
868 s->current);
869
870 n = scsi_req_enqueue(s->current->req);
871 if (n) {
872 if (n > 0) {
873 lsi_set_phase(s, PHASE_DI);
874 } else if (n < 0) {
875 lsi_set_phase(s, PHASE_DO);
876 }
877 scsi_req_continue(s->current->req);
878 }
879 if (!s->command_complete) {
880 if (n) {
881 /* Command did not complete immediately so disconnect. */
882 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
883 lsi_add_msg_byte(s, 4); /* DISCONNECT */
884 /* wait data */
885 lsi_set_phase(s, PHASE_MI);
886 s->msg_action = LSI_MSG_ACTION_DISCONNECT;
887 lsi_queue_command(s);
888 } else {
889 /* wait command complete */
890 lsi_set_phase(s, PHASE_DI);
891 }
892 }
893 }
894
895 static void lsi_do_status(LSIState *s)
896 {
897 uint8_t status;
898 trace_lsi_do_status(s->dbc, s->status);
899 if (s->dbc != 1) {
900 trace_lsi_do_status_error();
901 }
902 s->dbc = 1;
903 status = s->status;
904 s->sfbr = status;
905 pci_dma_write(PCI_DEVICE(s), s->dnad, &status, 1);
906 lsi_set_phase(s, PHASE_MI);
907 s->msg_action = LSI_MSG_ACTION_DISCONNECT;
908 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
909 }
910
911 static void lsi_do_msgin(LSIState *s)
912 {
913 uint8_t len;
914 trace_lsi_do_msgin(s->dbc, s->msg_len);
915 s->sfbr = s->msg[0];
916 len = s->msg_len;
917 assert(len > 0 && len <= LSI_MAX_MSGIN_LEN);
918 if (len > s->dbc)
919 len = s->dbc;
920 pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
921 /* Linux drivers rely on the last byte being in the SIDL. */
922 s->sidl = s->msg[len - 1];
923 s->msg_len -= len;
924 if (s->msg_len) {
925 memmove(s->msg, s->msg + len, s->msg_len);
926 } else {
927 /* ??? Check if ATN (not yet implemented) is asserted and maybe
928 switch to PHASE_MO. */
929 switch (s->msg_action) {
930 case LSI_MSG_ACTION_COMMAND:
931 lsi_set_phase(s, PHASE_CMD);
932 break;
933 case LSI_MSG_ACTION_DISCONNECT:
934 lsi_disconnect(s);
935 break;
936 case LSI_MSG_ACTION_DOUT:
937 lsi_set_phase(s, PHASE_DO);
938 break;
939 case LSI_MSG_ACTION_DIN:
940 lsi_set_phase(s, PHASE_DI);
941 break;
942 default:
943 abort();
944 }
945 }
946 }
947
948 /* Read the next byte during a MSGOUT phase. */
949 static uint8_t lsi_get_msgbyte(LSIState *s)
950 {
951 uint8_t data;
952 pci_dma_read(PCI_DEVICE(s), s->dnad, &data, 1);
953 s->dnad++;
954 s->dbc--;
955 return data;
956 }
957
958 /* Skip the next n bytes during a MSGOUT phase. */
959 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
960 {
961 s->dnad += n;
962 s->dbc -= n;
963 }
964
965 static void lsi_do_msgout(LSIState *s)
966 {
967 uint8_t msg;
968 int len;
969 uint32_t current_tag;
970 lsi_request *current_req, *p, *p_next;
971
972 if (s->current) {
973 current_tag = s->current->tag;
974 current_req = s->current;
975 } else {
976 current_tag = s->select_tag;
977 current_req = lsi_find_by_tag(s, current_tag);
978 }
979
980 trace_lsi_do_msgout(s->dbc);
981 while (s->dbc) {
982 msg = lsi_get_msgbyte(s);
983 s->sfbr = msg;
984
985 switch (msg) {
986 case 0x04:
987 trace_lsi_do_msgout_disconnect();
988 lsi_disconnect(s);
989 break;
990 case 0x08:
991 trace_lsi_do_msgout_noop();
992 lsi_set_phase(s, PHASE_CMD);
993 break;
994 case 0x01:
995 len = lsi_get_msgbyte(s);
996 msg = lsi_get_msgbyte(s);
997 (void)len; /* avoid a warning about unused variable*/
998 trace_lsi_do_msgout_extended(msg, len);
999 switch (msg) {
1000 case 1:
1001 trace_lsi_do_msgout_ignored("SDTR");
1002 lsi_skip_msgbytes(s, 2);
1003 break;
1004 case 3:
1005 trace_lsi_do_msgout_ignored("WDTR");
1006 lsi_skip_msgbytes(s, 1);
1007 break;
1008 case 4:
1009 trace_lsi_do_msgout_ignored("PPR");
1010 lsi_skip_msgbytes(s, 5);
1011 break;
1012 default:
1013 goto bad;
1014 }
1015 break;
1016 case 0x20: /* SIMPLE queue */
1017 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
1018 trace_lsi_do_msgout_simplequeue(s->select_tag & 0xff);
1019 break;
1020 case 0x21: /* HEAD of queue */
1021 qemu_log_mask(LOG_UNIMP, "lsi_scsi: HEAD queue not implemented\n");
1022 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
1023 break;
1024 case 0x22: /* ORDERED queue */
1025 qemu_log_mask(LOG_UNIMP,
1026 "lsi_scsi: ORDERED queue not implemented\n");
1027 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
1028 break;
1029 case 0x0d:
1030 /* The ABORT TAG message clears the current I/O process only. */
1031 trace_lsi_do_msgout_abort(current_tag);
1032 if (current_req) {
1033 scsi_req_cancel(current_req->req);
1034 }
1035 lsi_disconnect(s);
1036 break;
1037 case 0x06:
1038 case 0x0e:
1039 case 0x0c:
1040 /* The ABORT message clears all I/O processes for the selecting
1041 initiator on the specified logical unit of the target. */
1042 if (msg == 0x06) {
1043 trace_lsi_do_msgout_abort(current_tag);
1044 }
1045 /* The CLEAR QUEUE message clears all I/O processes for all
1046 initiators on the specified logical unit of the target. */
1047 if (msg == 0x0e) {
1048 trace_lsi_do_msgout_clearqueue(current_tag);
1049 }
1050 /* The BUS DEVICE RESET message clears all I/O processes for all
1051 initiators on all logical units of the target. */
1052 if (msg == 0x0c) {
1053 trace_lsi_do_msgout_busdevicereset(current_tag);
1054 }
1055
1056 /* clear the current I/O process */
1057 if (s->current) {
1058 scsi_req_cancel(s->current->req);
1059 }
1060
1061 /* As the current implemented devices scsi_disk and scsi_generic
1062 only support one LUN, we don't need to keep track of LUNs.
1063 Clearing I/O processes for other initiators could be possible
1064 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
1065 device, but this is currently not implemented (and seems not
1066 to be really necessary). So let's simply clear all queued
1067 commands for the current device: */
1068 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
1069 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
1070 scsi_req_cancel(p->req);
1071 }
1072 }
1073
1074 lsi_disconnect(s);
1075 break;
1076 default:
1077 if ((msg & 0x80) == 0) {
1078 goto bad;
1079 }
1080 s->current_lun = msg & 7;
1081 trace_lsi_do_msgout_select(s->current_lun);
1082 lsi_set_phase(s, PHASE_CMD);
1083 break;
1084 }
1085 }
1086 return;
1087 bad:
1088 qemu_log_mask(LOG_UNIMP, "Unimplemented message 0x%02x\n", msg);
1089 lsi_set_phase(s, PHASE_MI);
1090 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
1091 s->msg_action = LSI_MSG_ACTION_COMMAND;
1092 }
1093
1094 #define LSI_BUF_SIZE 4096
1095 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1096 {
1097 int n;
1098 uint8_t buf[LSI_BUF_SIZE];
1099
1100 trace_lsi_memcpy(dest, src, count);
1101 while (count) {
1102 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1103 lsi_mem_read(s, src, buf, n);
1104 lsi_mem_write(s, dest, buf, n);
1105 src += n;
1106 dest += n;
1107 count -= n;
1108 }
1109 }
1110
1111 static void lsi_wait_reselect(LSIState *s)
1112 {
1113 lsi_request *p;
1114
1115 trace_lsi_wait_reselect();
1116
1117 if (s->current) {
1118 return;
1119 }
1120 p = get_pending_req(s);
1121 if (p) {
1122 lsi_reselect(s, p);
1123 }
1124 if (s->current == NULL) {
1125 s->waiting = LSI_WAIT_RESELECT;
1126 }
1127 }
1128
1129 static void lsi_execute_script(LSIState *s)
1130 {
1131 PCIDevice *pci_dev = PCI_DEVICE(s);
1132 uint32_t insn;
1133 uint32_t addr, addr_high;
1134 int opcode;
1135 int insn_processed = 0;
1136
1137 s->istat1 |= LSI_ISTAT1_SRUN;
1138 again:
1139 if (++insn_processed > LSI_MAX_INSN) {
1140 /* Some windows drivers make the device spin waiting for a memory
1141 location to change. If we have been executed a lot of code then
1142 assume this is the case and force an unexpected device disconnect.
1143 This is apparently sufficient to beat the drivers into submission.
1144 */
1145 if (!(s->sien0 & LSI_SIST0_UDC)) {
1146 qemu_log_mask(LOG_GUEST_ERROR,
1147 "lsi_scsi: inf. loop with UDC masked");
1148 }
1149 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1150 lsi_disconnect(s);
1151 trace_lsi_execute_script_stop();
1152 return;
1153 }
1154 insn = read_dword(s, s->dsp);
1155 if (!insn) {
1156 /* If we receive an empty opcode increment the DSP by 4 bytes
1157 instead of 8 and execute the next opcode at that location */
1158 s->dsp += 4;
1159 goto again;
1160 }
1161 addr = read_dword(s, s->dsp + 4);
1162 addr_high = 0;
1163 trace_lsi_execute_script(s->dsp, insn, addr);
1164 s->dsps = addr;
1165 s->dcmd = insn >> 24;
1166 s->dsp += 8;
1167 switch (insn >> 30) {
1168 case 0: /* Block move. */
1169 if (s->sist1 & LSI_SIST1_STO) {
1170 trace_lsi_execute_script_blockmove_delayed();
1171 lsi_stop_script(s);
1172 break;
1173 }
1174 s->dbc = insn & 0xffffff;
1175 s->rbc = s->dbc;
1176 /* ??? Set ESA. */
1177 s->ia = s->dsp - 8;
1178 if (insn & (1 << 29)) {
1179 /* Indirect addressing. */
1180 addr = read_dword(s, addr);
1181 } else if (insn & (1 << 28)) {
1182 uint32_t buf[2];
1183 int32_t offset;
1184 /* Table indirect addressing. */
1185
1186 /* 32-bit Table indirect */
1187 offset = sextract32(addr, 0, 24);
1188 pci_dma_read(pci_dev, s->dsa + offset, buf, 8);
1189 /* byte count is stored in bits 0:23 only */
1190 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1191 s->rbc = s->dbc;
1192 addr = cpu_to_le32(buf[1]);
1193
1194 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1195 * table, bits [31:24] */
1196 if (lsi_dma_40bit(s))
1197 addr_high = cpu_to_le32(buf[0]) >> 24;
1198 else if (lsi_dma_ti64bit(s)) {
1199 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1200 switch (selector) {
1201 case 0 ... 0x0f:
1202 /* offset index into scratch registers since
1203 * TI64 mode can use registers C to R */
1204 addr_high = s->scratch[2 + selector];
1205 break;
1206 case 0x10:
1207 addr_high = s->mmrs;
1208 break;
1209 case 0x11:
1210 addr_high = s->mmws;
1211 break;
1212 case 0x12:
1213 addr_high = s->sfs;
1214 break;
1215 case 0x13:
1216 addr_high = s->drs;
1217 break;
1218 case 0x14:
1219 addr_high = s->sbms;
1220 break;
1221 case 0x15:
1222 addr_high = s->dbms;
1223 break;
1224 default:
1225 qemu_log_mask(LOG_GUEST_ERROR,
1226 "lsi_scsi: Illegal selector specified (0x%x > 0x15) "
1227 "for 64-bit DMA block move", selector);
1228 break;
1229 }
1230 }
1231 } else if (lsi_dma_64bit(s)) {
1232 /* fetch a 3rd dword if 64-bit direct move is enabled and
1233 only if we're not doing table indirect or indirect addressing */
1234 s->dbms = read_dword(s, s->dsp);
1235 s->dsp += 4;
1236 s->ia = s->dsp - 12;
1237 }
1238 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1239 trace_lsi_execute_script_blockmove_badphase(
1240 scsi_phase_name(s->sstat1),
1241 scsi_phase_name(insn >> 24));
1242 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1243 break;
1244 }
1245 s->dnad = addr;
1246 s->dnad64 = addr_high;
1247 switch (s->sstat1 & 0x7) {
1248 case PHASE_DO:
1249 s->waiting = LSI_DMA_SCRIPTS;
1250 lsi_do_dma(s, 1);
1251 if (s->waiting)
1252 s->waiting = LSI_DMA_IN_PROGRESS;
1253 break;
1254 case PHASE_DI:
1255 s->waiting = LSI_DMA_SCRIPTS;
1256 lsi_do_dma(s, 0);
1257 if (s->waiting)
1258 s->waiting = LSI_DMA_IN_PROGRESS;
1259 break;
1260 case PHASE_CMD:
1261 lsi_do_command(s);
1262 break;
1263 case PHASE_ST:
1264 lsi_do_status(s);
1265 break;
1266 case PHASE_MO:
1267 lsi_do_msgout(s);
1268 break;
1269 case PHASE_MI:
1270 lsi_do_msgin(s);
1271 break;
1272 default:
1273 qemu_log_mask(LOG_UNIMP, "lsi_scsi: Unimplemented phase %s\n",
1274 scsi_phase_name(s->sstat1));
1275 }
1276 s->dfifo = s->dbc & 0xff;
1277 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1278 s->sbc = s->dbc;
1279 s->rbc -= s->dbc;
1280 s->ua = addr + s->dbc;
1281 break;
1282
1283 case 1: /* IO or Read/Write instruction. */
1284 opcode = (insn >> 27) & 7;
1285 if (opcode < 5) {
1286 uint32_t id;
1287
1288 if (insn & (1 << 25)) {
1289 id = read_dword(s, s->dsa + sextract32(insn, 0, 24));
1290 } else {
1291 id = insn;
1292 }
1293 id = (id >> 16) & 0xf;
1294 if (insn & (1 << 26)) {
1295 addr = s->dsp + sextract32(addr, 0, 24);
1296 }
1297 s->dnad = addr;
1298 switch (opcode) {
1299 case 0: /* Select */
1300 s->sdid = id;
1301 if (s->scntl1 & LSI_SCNTL1_CON) {
1302 trace_lsi_execute_script_io_alreadyreselected();
1303 s->dsp = s->dnad;
1304 break;
1305 }
1306 s->sstat0 |= LSI_SSTAT0_WOA;
1307 s->scntl1 &= ~LSI_SCNTL1_IARB;
1308 if (!scsi_device_find(&s->bus, 0, id, 0)) {
1309 lsi_bad_selection(s, id);
1310 break;
1311 }
1312 trace_lsi_execute_script_io_selected(id,
1313 insn & (1 << 3) ? " ATN" : "");
1314 /* ??? Linux drivers compain when this is set. Maybe
1315 it only applies in low-level mode (unimplemented).
1316 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1317 s->select_tag = id << 8;
1318 s->scntl1 |= LSI_SCNTL1_CON;
1319 if (insn & (1 << 3)) {
1320 s->socl |= LSI_SOCL_ATN;
1321 s->sbcl |= LSI_SBCL_ATN;
1322 }
1323 s->sbcl |= LSI_SBCL_BSY;
1324 lsi_set_phase(s, PHASE_MO);
1325 s->waiting = LSI_NOWAIT;
1326 break;
1327 case 1: /* Disconnect */
1328 trace_lsi_execute_script_io_disconnect();
1329 s->scntl1 &= ~LSI_SCNTL1_CON;
1330 /* FIXME: this is not entirely correct; the target need not ask
1331 * for reselection until it has to send data, while here we force a
1332 * reselection as soon as the bus is free. The correct flow would
1333 * reselect before lsi_transfer_data and disconnect as soon as
1334 * DMA ends.
1335 */
1336 if (!s->current) {
1337 lsi_request *p = get_pending_req(s);
1338 if (p) {
1339 lsi_reselect(s, p);
1340 }
1341 }
1342 break;
1343 case 2: /* Wait Reselect */
1344 if (s->istat0 & LSI_ISTAT0_SIGP) {
1345 s->dsp = s->dnad;
1346 } else if (!lsi_irq_on_rsl(s)) {
1347 lsi_wait_reselect(s);
1348 }
1349 break;
1350 case 3: /* Set */
1351 trace_lsi_execute_script_io_set(
1352 insn & (1 << 3) ? " ATN" : "",
1353 insn & (1 << 6) ? " ACK" : "",
1354 insn & (1 << 9) ? " TM" : "",
1355 insn & (1 << 10) ? " CC" : "");
1356 if (insn & (1 << 3)) {
1357 s->socl |= LSI_SOCL_ATN;
1358 s->sbcl |= LSI_SBCL_ATN;
1359 lsi_set_phase(s, PHASE_MO);
1360 }
1361
1362 if (insn & (1 << 6)) {
1363 s->sbcl |= LSI_SBCL_ACK;
1364 }
1365
1366 if (insn & (1 << 9)) {
1367 qemu_log_mask(LOG_UNIMP,
1368 "lsi_scsi: Target mode not implemented\n");
1369 }
1370 if (insn & (1 << 10))
1371 s->carry = 1;
1372 break;
1373 case 4: /* Clear */
1374 trace_lsi_execute_script_io_clear(
1375 insn & (1 << 3) ? " ATN" : "",
1376 insn & (1 << 6) ? " ACK" : "",
1377 insn & (1 << 9) ? " TM" : "",
1378 insn & (1 << 10) ? " CC" : "");
1379 if (insn & (1 << 3)) {
1380 s->socl &= ~LSI_SOCL_ATN;
1381 s->sbcl &= ~LSI_SBCL_ATN;
1382 }
1383
1384 if (insn & (1 << 6)) {
1385 s->sbcl &= ~LSI_SBCL_ACK;
1386 }
1387
1388 if (insn & (1 << 10))
1389 s->carry = 0;
1390 break;
1391 }
1392 } else {
1393 uint8_t op0;
1394 uint8_t op1;
1395 uint8_t data8;
1396 int reg;
1397 int operator;
1398
1399 static const char *opcode_names[3] =
1400 {"Write", "Read", "Read-Modify-Write"};
1401 static const char *operator_names[8] =
1402 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1403
1404 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1405 data8 = (insn >> 8) & 0xff;
1406 opcode = (insn >> 27) & 7;
1407 operator = (insn >> 24) & 7;
1408 trace_lsi_execute_script_io_opcode(
1409 opcode_names[opcode - 5], reg,
1410 operator_names[operator], data8, s->sfbr,
1411 (insn & (1 << 23)) ? " SFBR" : "");
1412 op0 = op1 = 0;
1413 switch (opcode) {
1414 case 5: /* From SFBR */
1415 op0 = s->sfbr;
1416 op1 = data8;
1417 break;
1418 case 6: /* To SFBR */
1419 if (operator)
1420 op0 = lsi_reg_readb(s, reg);
1421 op1 = data8;
1422 break;
1423 case 7: /* Read-modify-write */
1424 if (operator)
1425 op0 = lsi_reg_readb(s, reg);
1426 if (insn & (1 << 23)) {
1427 op1 = s->sfbr;
1428 } else {
1429 op1 = data8;
1430 }
1431 break;
1432 }
1433
1434 switch (operator) {
1435 case 0: /* move */
1436 op0 = op1;
1437 break;
1438 case 1: /* Shift left */
1439 op1 = op0 >> 7;
1440 op0 = (op0 << 1) | s->carry;
1441 s->carry = op1;
1442 break;
1443 case 2: /* OR */
1444 op0 |= op1;
1445 break;
1446 case 3: /* XOR */
1447 op0 ^= op1;
1448 break;
1449 case 4: /* AND */
1450 op0 &= op1;
1451 break;
1452 case 5: /* SHR */
1453 op1 = op0 & 1;
1454 op0 = (op0 >> 1) | (s->carry << 7);
1455 s->carry = op1;
1456 break;
1457 case 6: /* ADD */
1458 op0 += op1;
1459 s->carry = op0 < op1;
1460 break;
1461 case 7: /* ADC */
1462 op0 += op1 + s->carry;
1463 if (s->carry)
1464 s->carry = op0 <= op1;
1465 else
1466 s->carry = op0 < op1;
1467 break;
1468 }
1469
1470 switch (opcode) {
1471 case 5: /* From SFBR */
1472 case 7: /* Read-modify-write */
1473 lsi_reg_writeb(s, reg, op0);
1474 break;
1475 case 6: /* To SFBR */
1476 s->sfbr = op0;
1477 break;
1478 }
1479 }
1480 break;
1481
1482 case 2: /* Transfer Control. */
1483 {
1484 int cond;
1485 int jmp;
1486
1487 if ((insn & 0x002e0000) == 0) {
1488 trace_lsi_execute_script_tc_nop();
1489 break;
1490 }
1491 if (s->sist1 & LSI_SIST1_STO) {
1492 trace_lsi_execute_script_tc_delayedselect_timeout();
1493 lsi_stop_script(s);
1494 break;
1495 }
1496 cond = jmp = (insn & (1 << 19)) != 0;
1497 if (cond == jmp && (insn & (1 << 21))) {
1498 trace_lsi_execute_script_tc_compc(s->carry == jmp);
1499 cond = s->carry != 0;
1500 }
1501 if (cond == jmp && (insn & (1 << 17))) {
1502 trace_lsi_execute_script_tc_compp(scsi_phase_name(s->sstat1),
1503 jmp ? '=' : '!', scsi_phase_name(insn >> 24));
1504 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1505 }
1506 if (cond == jmp && (insn & (1 << 18))) {
1507 uint8_t mask;
1508
1509 mask = (~insn >> 8) & 0xff;
1510 trace_lsi_execute_script_tc_compd(
1511 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1512 cond = (s->sfbr & mask) == (insn & mask);
1513 }
1514 if (cond == jmp) {
1515 if (insn & (1 << 23)) {
1516 /* Relative address. */
1517 addr = s->dsp + sextract32(addr, 0, 24);
1518 }
1519 switch ((insn >> 27) & 7) {
1520 case 0: /* Jump */
1521 trace_lsi_execute_script_tc_jump(addr);
1522 s->adder = addr;
1523 s->dsp = addr;
1524 break;
1525 case 1: /* Call */
1526 trace_lsi_execute_script_tc_call(addr);
1527 s->temp = s->dsp;
1528 s->dsp = addr;
1529 break;
1530 case 2: /* Return */
1531 trace_lsi_execute_script_tc_return(s->temp);
1532 s->dsp = s->temp;
1533 break;
1534 case 3: /* Interrupt */
1535 trace_lsi_execute_script_tc_interrupt(s->dsps);
1536 if ((insn & (1 << 20)) != 0) {
1537 s->istat0 |= LSI_ISTAT0_INTF;
1538 lsi_update_irq(s);
1539 } else {
1540 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1541 }
1542 break;
1543 default:
1544 trace_lsi_execute_script_tc_illegal();
1545 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1546 break;
1547 }
1548 } else {
1549 trace_lsi_execute_script_tc_cc_failed();
1550 }
1551 }
1552 break;
1553
1554 case 3:
1555 if ((insn & (1 << 29)) == 0) {
1556 /* Memory move. */
1557 uint32_t dest;
1558 /* ??? The docs imply the destination address is loaded into
1559 the TEMP register. However the Linux drivers rely on
1560 the value being presrved. */
1561 dest = read_dword(s, s->dsp);
1562 s->dsp += 4;
1563 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1564 } else {
1565 uint8_t data[7];
1566 int reg;
1567 int n;
1568 int i;
1569
1570 if (insn & (1 << 28)) {
1571 addr = s->dsa + sextract32(addr, 0, 24);
1572 }
1573 n = (insn & 7);
1574 reg = (insn >> 16) & 0xff;
1575 if (insn & (1 << 24)) {
1576 pci_dma_read(pci_dev, addr, data, n);
1577 trace_lsi_execute_script_mm_load(reg, n, addr, *(int *)data);
1578 for (i = 0; i < n; i++) {
1579 lsi_reg_writeb(s, reg + i, data[i]);
1580 }
1581 } else {
1582 trace_lsi_execute_script_mm_store(reg, n, addr);
1583 for (i = 0; i < n; i++) {
1584 data[i] = lsi_reg_readb(s, reg + i);
1585 }
1586 pci_dma_write(pci_dev, addr, data, n);
1587 }
1588 }
1589 }
1590 if (s->istat1 & LSI_ISTAT1_SRUN && s->waiting == LSI_NOWAIT) {
1591 if (s->dcntl & LSI_DCNTL_SSM) {
1592 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1593 } else {
1594 goto again;
1595 }
1596 }
1597 trace_lsi_execute_script_stop();
1598 }
1599
1600 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1601 {
1602 uint8_t ret;
1603
1604 #define CASE_GET_REG24(name, addr) \
1605 case addr: ret = s->name & 0xff; break; \
1606 case addr + 1: ret = (s->name >> 8) & 0xff; break; \
1607 case addr + 2: ret = (s->name >> 16) & 0xff; break;
1608
1609 #define CASE_GET_REG32(name, addr) \
1610 case addr: ret = s->name & 0xff; break; \
1611 case addr + 1: ret = (s->name >> 8) & 0xff; break; \
1612 case addr + 2: ret = (s->name >> 16) & 0xff; break; \
1613 case addr + 3: ret = (s->name >> 24) & 0xff; break;
1614
1615 switch (offset) {
1616 case 0x00: /* SCNTL0 */
1617 ret = s->scntl0;
1618 break;
1619 case 0x01: /* SCNTL1 */
1620 ret = s->scntl1;
1621 break;
1622 case 0x02: /* SCNTL2 */
1623 ret = s->scntl2;
1624 break;
1625 case 0x03: /* SCNTL3 */
1626 ret = s->scntl3;
1627 break;
1628 case 0x04: /* SCID */
1629 ret = s->scid;
1630 break;
1631 case 0x05: /* SXFER */
1632 ret = s->sxfer;
1633 break;
1634 case 0x06: /* SDID */
1635 ret = s->sdid;
1636 break;
1637 case 0x07: /* GPREG0 */
1638 ret = 0x7f;
1639 break;
1640 case 0x08: /* Revision ID */
1641 ret = 0x00;
1642 break;
1643 case 0x09: /* SOCL */
1644 ret = s->socl;
1645 break;
1646 case 0xa: /* SSID */
1647 ret = s->ssid;
1648 break;
1649 case 0xb: /* SBCL */
1650 ret = s->sbcl;
1651 break;
1652 case 0xc: /* DSTAT */
1653 ret = s->dstat | LSI_DSTAT_DFE;
1654 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1655 s->dstat = 0;
1656 lsi_update_irq(s);
1657 break;
1658 case 0x0d: /* SSTAT0 */
1659 ret = s->sstat0;
1660 break;
1661 case 0x0e: /* SSTAT1 */
1662 ret = s->sstat1;
1663 break;
1664 case 0x0f: /* SSTAT2 */
1665 ret = s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1666 break;
1667 CASE_GET_REG32(dsa, 0x10)
1668 case 0x14: /* ISTAT0 */
1669 ret = s->istat0;
1670 break;
1671 case 0x15: /* ISTAT1 */
1672 ret = s->istat1;
1673 break;
1674 case 0x16: /* MBOX0 */
1675 ret = s->mbox0;
1676 break;
1677 case 0x17: /* MBOX1 */
1678 ret = s->mbox1;
1679 break;
1680 case 0x18: /* CTEST0 */
1681 ret = 0xff;
1682 break;
1683 case 0x19: /* CTEST1 */
1684 ret = 0;
1685 break;
1686 case 0x1a: /* CTEST2 */
1687 ret = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1688 if (s->istat0 & LSI_ISTAT0_SIGP) {
1689 s->istat0 &= ~LSI_ISTAT0_SIGP;
1690 ret |= LSI_CTEST2_SIGP;
1691 }
1692 break;
1693 case 0x1b: /* CTEST3 */
1694 ret = s->ctest3;
1695 break;
1696 CASE_GET_REG32(temp, 0x1c)
1697 case 0x20: /* DFIFO */
1698 ret = s->dfifo;
1699 break;
1700 case 0x21: /* CTEST4 */
1701 ret = s->ctest4;
1702 break;
1703 case 0x22: /* CTEST5 */
1704 ret = s->ctest5;
1705 break;
1706 case 0x23: /* CTEST6 */
1707 ret = 0;
1708 break;
1709 CASE_GET_REG24(dbc, 0x24)
1710 case 0x27: /* DCMD */
1711 ret = s->dcmd;
1712 break;
1713 CASE_GET_REG32(dnad, 0x28)
1714 CASE_GET_REG32(dsp, 0x2c)
1715 CASE_GET_REG32(dsps, 0x30)
1716 CASE_GET_REG32(scratch[0], 0x34)
1717 case 0x38: /* DMODE */
1718 ret = s->dmode;
1719 break;
1720 case 0x39: /* DIEN */
1721 ret = s->dien;
1722 break;
1723 case 0x3a: /* SBR */
1724 ret = s->sbr;
1725 break;
1726 case 0x3b: /* DCNTL */
1727 ret = s->dcntl;
1728 break;
1729 /* ADDER Output (Debug of relative jump address) */
1730 CASE_GET_REG32(adder, 0x3c)
1731 case 0x40: /* SIEN0 */
1732 ret = s->sien0;
1733 break;
1734 case 0x41: /* SIEN1 */
1735 ret = s->sien1;
1736 break;
1737 case 0x42: /* SIST0 */
1738 ret = s->sist0;
1739 s->sist0 = 0;
1740 lsi_update_irq(s);
1741 break;
1742 case 0x43: /* SIST1 */
1743 ret = s->sist1;
1744 s->sist1 = 0;
1745 lsi_update_irq(s);
1746 break;
1747 case 0x46: /* MACNTL */
1748 ret = 0x0f;
1749 break;
1750 case 0x47: /* GPCNTL0 */
1751 ret = 0x0f;
1752 break;
1753 case 0x48: /* STIME0 */
1754 ret = s->stime0;
1755 break;
1756 case 0x4a: /* RESPID0 */
1757 ret = s->respid0;
1758 break;
1759 case 0x4b: /* RESPID1 */
1760 ret = s->respid1;
1761 break;
1762 case 0x4d: /* STEST1 */
1763 ret = s->stest1;
1764 break;
1765 case 0x4e: /* STEST2 */
1766 ret = s->stest2;
1767 break;
1768 case 0x4f: /* STEST3 */
1769 ret = s->stest3;
1770 break;
1771 case 0x50: /* SIDL */
1772 /* This is needed by the linux drivers. We currently only update it
1773 during the MSG IN phase. */
1774 ret = s->sidl;
1775 break;
1776 case 0x52: /* STEST4 */
1777 ret = 0xe0;
1778 break;
1779 case 0x56: /* CCNTL0 */
1780 ret = s->ccntl0;
1781 break;
1782 case 0x57: /* CCNTL1 */
1783 ret = s->ccntl1;
1784 break;
1785 case 0x58: /* SBDL */
1786 /* Some drivers peek at the data bus during the MSG IN phase. */
1787 if ((s->sstat1 & PHASE_MASK) == PHASE_MI) {
1788 assert(s->msg_len > 0);
1789 return s->msg[0];
1790 }
1791 ret = 0;
1792 break;
1793 case 0x59: /* SBDL high */
1794 ret = 0;
1795 break;
1796 CASE_GET_REG32(mmrs, 0xa0)
1797 CASE_GET_REG32(mmws, 0xa4)
1798 CASE_GET_REG32(sfs, 0xa8)
1799 CASE_GET_REG32(drs, 0xac)
1800 CASE_GET_REG32(sbms, 0xb0)
1801 CASE_GET_REG32(dbms, 0xb4)
1802 CASE_GET_REG32(dnad64, 0xb8)
1803 CASE_GET_REG32(pmjad1, 0xc0)
1804 CASE_GET_REG32(pmjad2, 0xc4)
1805 CASE_GET_REG32(rbc, 0xc8)
1806 CASE_GET_REG32(ua, 0xcc)
1807 CASE_GET_REG32(ia, 0xd4)
1808 CASE_GET_REG32(sbc, 0xd8)
1809 CASE_GET_REG32(csbc, 0xdc)
1810 case 0x5c ... 0x9f:
1811 {
1812 int n;
1813 int shift;
1814 n = (offset - 0x58) >> 2;
1815 shift = (offset & 3) * 8;
1816 ret = (s->scratch[n] >> shift) & 0xff;
1817 break;
1818 }
1819 default:
1820 {
1821 qemu_log_mask(LOG_GUEST_ERROR,
1822 "lsi_scsi: invalid read from reg %s %x\n",
1823 offset < ARRAY_SIZE(names) ? names[offset] : "???",
1824 offset);
1825 ret = 0xff;
1826 break;
1827 }
1828 }
1829 #undef CASE_GET_REG24
1830 #undef CASE_GET_REG32
1831
1832 trace_lsi_reg_read(offset < ARRAY_SIZE(names) ? names[offset] : "???",
1833 offset, ret);
1834
1835 return ret;
1836 }
1837
1838 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1839 {
1840 #define CASE_SET_REG24(name, addr) \
1841 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1842 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1843 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1844
1845 #define CASE_SET_REG32(name, addr) \
1846 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1847 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1848 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1849 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1850
1851 trace_lsi_reg_write(offset < ARRAY_SIZE(names) ? names[offset] : "???",
1852 offset, val);
1853
1854 switch (offset) {
1855 case 0x00: /* SCNTL0 */
1856 s->scntl0 = val;
1857 if (val & LSI_SCNTL0_START) {
1858 qemu_log_mask(LOG_UNIMP,
1859 "lsi_scsi: Start sequence not implemented\n");
1860 }
1861 break;
1862 case 0x01: /* SCNTL1 */
1863 s->scntl1 = val & ~LSI_SCNTL1_SST;
1864 if (val & LSI_SCNTL1_IARB) {
1865 qemu_log_mask(LOG_UNIMP,
1866 "lsi_scsi: Immediate Arbritration not implemented\n");
1867 }
1868 if (val & LSI_SCNTL1_RST) {
1869 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1870 qbus_reset_all(BUS(&s->bus));
1871 s->sstat0 |= LSI_SSTAT0_RST;
1872 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1873 }
1874 } else {
1875 s->sstat0 &= ~LSI_SSTAT0_RST;
1876 }
1877 break;
1878 case 0x02: /* SCNTL2 */
1879 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1880 s->scntl2 = val;
1881 break;
1882 case 0x03: /* SCNTL3 */
1883 s->scntl3 = val;
1884 break;
1885 case 0x04: /* SCID */
1886 s->scid = val;
1887 break;
1888 case 0x05: /* SXFER */
1889 s->sxfer = val;
1890 break;
1891 case 0x06: /* SDID */
1892 if ((s->ssid & 0x80) && (val & 0xf) != (s->ssid & 0xf)) {
1893 qemu_log_mask(LOG_GUEST_ERROR,
1894 "lsi_scsi: Destination ID does not match SSID\n");
1895 }
1896 s->sdid = val & 0xf;
1897 break;
1898 case 0x07: /* GPREG0 */
1899 break;
1900 case 0x08: /* SFBR */
1901 /* The CPU is not allowed to write to this register. However the
1902 SCRIPTS register move instructions are. */
1903 s->sfbr = val;
1904 break;
1905 case 0x0a: case 0x0b:
1906 /* Openserver writes to these readonly registers on startup */
1907 return;
1908 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1909 /* Linux writes to these readonly registers on startup. */
1910 return;
1911 CASE_SET_REG32(dsa, 0x10)
1912 case 0x14: /* ISTAT0 */
1913 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1914 if (val & LSI_ISTAT0_ABRT) {
1915 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1916 }
1917 if (val & LSI_ISTAT0_INTF) {
1918 s->istat0 &= ~LSI_ISTAT0_INTF;
1919 lsi_update_irq(s);
1920 }
1921 if (s->waiting == LSI_WAIT_RESELECT && val & LSI_ISTAT0_SIGP) {
1922 trace_lsi_awoken();
1923 s->waiting = LSI_NOWAIT;
1924 s->dsp = s->dnad;
1925 lsi_execute_script(s);
1926 }
1927 if (val & LSI_ISTAT0_SRST) {
1928 qdev_reset_all(DEVICE(s));
1929 }
1930 break;
1931 case 0x16: /* MBOX0 */
1932 s->mbox0 = val;
1933 break;
1934 case 0x17: /* MBOX1 */
1935 s->mbox1 = val;
1936 break;
1937 case 0x18: /* CTEST0 */
1938 /* nothing to do */
1939 break;
1940 case 0x1a: /* CTEST2 */
1941 s->ctest2 = val & LSI_CTEST2_PCICIE;
1942 break;
1943 case 0x1b: /* CTEST3 */
1944 s->ctest3 = val & 0x0f;
1945 break;
1946 CASE_SET_REG32(temp, 0x1c)
1947 case 0x21: /* CTEST4 */
1948 if (val & 7) {
1949 qemu_log_mask(LOG_UNIMP,
1950 "lsi_scsi: Unimplemented CTEST4-FBL 0x%x\n", val);
1951 }
1952 s->ctest4 = val;
1953 break;
1954 case 0x22: /* CTEST5 */
1955 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1956 qemu_log_mask(LOG_UNIMP,
1957 "lsi_scsi: CTEST5 DMA increment not implemented\n");
1958 }
1959 s->ctest5 = val;
1960 break;
1961 CASE_SET_REG24(dbc, 0x24)
1962 CASE_SET_REG32(dnad, 0x28)
1963 case 0x2c: /* DSP[0:7] */
1964 s->dsp &= 0xffffff00;
1965 s->dsp |= val;
1966 break;
1967 case 0x2d: /* DSP[8:15] */
1968 s->dsp &= 0xffff00ff;
1969 s->dsp |= val << 8;
1970 break;
1971 case 0x2e: /* DSP[16:23] */
1972 s->dsp &= 0xff00ffff;
1973 s->dsp |= val << 16;
1974 break;
1975 case 0x2f: /* DSP[24:31] */
1976 s->dsp &= 0x00ffffff;
1977 s->dsp |= val << 24;
1978 /*
1979 * FIXME: if s->waiting != LSI_NOWAIT, this will only execute one
1980 * instruction. Is this correct?
1981 */
1982 if ((s->dmode & LSI_DMODE_MAN) == 0
1983 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1984 lsi_execute_script(s);
1985 break;
1986 CASE_SET_REG32(dsps, 0x30)
1987 CASE_SET_REG32(scratch[0], 0x34)
1988 case 0x38: /* DMODE */
1989 s->dmode = val;
1990 break;
1991 case 0x39: /* DIEN */
1992 s->dien = val;
1993 lsi_update_irq(s);
1994 break;
1995 case 0x3a: /* SBR */
1996 s->sbr = val;
1997 break;
1998 case 0x3b: /* DCNTL */
1999 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
2000 /*
2001 * FIXME: if s->waiting != LSI_NOWAIT, this will only execute one
2002 * instruction. Is this correct?
2003 */
2004 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
2005 lsi_execute_script(s);
2006 break;
2007 case 0x40: /* SIEN0 */
2008 s->sien0 = val;
2009 lsi_update_irq(s);
2010 break;
2011 case 0x41: /* SIEN1 */
2012 s->sien1 = val;
2013 lsi_update_irq(s);
2014 break;
2015 case 0x47: /* GPCNTL0 */
2016 break;
2017 case 0x48: /* STIME0 */
2018 s->stime0 = val;
2019 break;
2020 case 0x49: /* STIME1 */
2021 if (val & 0xf) {
2022 qemu_log_mask(LOG_UNIMP,
2023 "lsi_scsi: General purpose timer not implemented\n");
2024 /* ??? Raising the interrupt immediately seems to be sufficient
2025 to keep the FreeBSD driver happy. */
2026 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
2027 }
2028 break;
2029 case 0x4a: /* RESPID0 */
2030 s->respid0 = val;
2031 break;
2032 case 0x4b: /* RESPID1 */
2033 s->respid1 = val;
2034 break;
2035 case 0x4d: /* STEST1 */
2036 s->stest1 = val;
2037 break;
2038 case 0x4e: /* STEST2 */
2039 if (val & 1) {
2040 qemu_log_mask(LOG_UNIMP,
2041 "lsi_scsi: Low level mode not implemented\n");
2042 }
2043 s->stest2 = val;
2044 break;
2045 case 0x4f: /* STEST3 */
2046 if (val & 0x41) {
2047 qemu_log_mask(LOG_UNIMP,
2048 "lsi_scsi: SCSI FIFO test mode not implemented\n");
2049 }
2050 s->stest3 = val;
2051 break;
2052 case 0x56: /* CCNTL0 */
2053 s->ccntl0 = val;
2054 break;
2055 case 0x57: /* CCNTL1 */
2056 s->ccntl1 = val;
2057 break;
2058 CASE_SET_REG32(mmrs, 0xa0)
2059 CASE_SET_REG32(mmws, 0xa4)
2060 CASE_SET_REG32(sfs, 0xa8)
2061 CASE_SET_REG32(drs, 0xac)
2062 CASE_SET_REG32(sbms, 0xb0)
2063 CASE_SET_REG32(dbms, 0xb4)
2064 CASE_SET_REG32(dnad64, 0xb8)
2065 CASE_SET_REG32(pmjad1, 0xc0)
2066 CASE_SET_REG32(pmjad2, 0xc4)
2067 CASE_SET_REG32(rbc, 0xc8)
2068 CASE_SET_REG32(ua, 0xcc)
2069 CASE_SET_REG32(ia, 0xd4)
2070 CASE_SET_REG32(sbc, 0xd8)
2071 CASE_SET_REG32(csbc, 0xdc)
2072 default:
2073 if (offset >= 0x5c && offset < 0xa0) {
2074 int n;
2075 int shift;
2076 n = (offset - 0x58) >> 2;
2077 shift = (offset & 3) * 8;
2078 s->scratch[n] = deposit32(s->scratch[n], shift, 8, val);
2079 } else {
2080 qemu_log_mask(LOG_GUEST_ERROR,
2081 "lsi_scsi: invalid write to reg %s %x (0x%02x)\n",
2082 offset < ARRAY_SIZE(names) ? names[offset] : "???",
2083 offset, val);
2084 }
2085 }
2086 #undef CASE_SET_REG24
2087 #undef CASE_SET_REG32
2088 }
2089
2090 static void lsi_mmio_write(void *opaque, hwaddr addr,
2091 uint64_t val, unsigned size)
2092 {
2093 LSIState *s = opaque;
2094
2095 lsi_reg_writeb(s, addr & 0xff, val);
2096 }
2097
2098 static uint64_t lsi_mmio_read(void *opaque, hwaddr addr,
2099 unsigned size)
2100 {
2101 LSIState *s = opaque;
2102 return lsi_reg_readb(s, addr & 0xff);
2103 }
2104
2105 static const MemoryRegionOps lsi_mmio_ops = {
2106 .read = lsi_mmio_read,
2107 .write = lsi_mmio_write,
2108 .endianness = DEVICE_LITTLE_ENDIAN,
2109 .impl = {
2110 .min_access_size = 1,
2111 .max_access_size = 1,
2112 },
2113 };
2114
2115 static void lsi_ram_write(void *opaque, hwaddr addr,
2116 uint64_t val, unsigned size)
2117 {
2118 LSIState *s = opaque;
2119 stn_le_p(s->script_ram + addr, size, val);
2120 }
2121
2122 static uint64_t lsi_ram_read(void *opaque, hwaddr addr,
2123 unsigned size)
2124 {
2125 LSIState *s = opaque;
2126 return ldn_le_p(s->script_ram + addr, size);
2127 }
2128
2129 static const MemoryRegionOps lsi_ram_ops = {
2130 .read = lsi_ram_read,
2131 .write = lsi_ram_write,
2132 .endianness = DEVICE_LITTLE_ENDIAN,
2133 };
2134
2135 static uint64_t lsi_io_read(void *opaque, hwaddr addr,
2136 unsigned size)
2137 {
2138 LSIState *s = opaque;
2139 return lsi_reg_readb(s, addr & 0xff);
2140 }
2141
2142 static void lsi_io_write(void *opaque, hwaddr addr,
2143 uint64_t val, unsigned size)
2144 {
2145 LSIState *s = opaque;
2146 lsi_reg_writeb(s, addr & 0xff, val);
2147 }
2148
2149 static const MemoryRegionOps lsi_io_ops = {
2150 .read = lsi_io_read,
2151 .write = lsi_io_write,
2152 .endianness = DEVICE_LITTLE_ENDIAN,
2153 .impl = {
2154 .min_access_size = 1,
2155 .max_access_size = 1,
2156 },
2157 };
2158
2159 static void lsi_scsi_reset(DeviceState *dev)
2160 {
2161 LSIState *s = LSI53C895A(dev);
2162
2163 lsi_soft_reset(s);
2164 }
2165
2166 static int lsi_pre_save(void *opaque)
2167 {
2168 LSIState *s = opaque;
2169
2170 if (s->current) {
2171 assert(s->current->dma_buf == NULL);
2172 assert(s->current->dma_len == 0);
2173 }
2174 assert(QTAILQ_EMPTY(&s->queue));
2175
2176 return 0;
2177 }
2178
2179 static int lsi_post_load(void *opaque, int version_id)
2180 {
2181 LSIState *s = opaque;
2182
2183 if (s->msg_len < 0 || s->msg_len > LSI_MAX_MSGIN_LEN) {
2184 return -EINVAL;
2185 }
2186
2187 return 0;
2188 }
2189
2190 static const VMStateDescription vmstate_lsi_scsi = {
2191 .name = "lsiscsi",
2192 .version_id = 1,
2193 .minimum_version_id = 0,
2194 .pre_save = lsi_pre_save,
2195 .post_load = lsi_post_load,
2196 .fields = (VMStateField[]) {
2197 VMSTATE_PCI_DEVICE(parent_obj, LSIState),
2198
2199 VMSTATE_INT32(carry, LSIState),
2200 VMSTATE_INT32(status, LSIState),
2201 VMSTATE_INT32(msg_action, LSIState),
2202 VMSTATE_INT32(msg_len, LSIState),
2203 VMSTATE_BUFFER(msg, LSIState),
2204 VMSTATE_INT32(waiting, LSIState),
2205
2206 VMSTATE_UINT32(dsa, LSIState),
2207 VMSTATE_UINT32(temp, LSIState),
2208 VMSTATE_UINT32(dnad, LSIState),
2209 VMSTATE_UINT32(dbc, LSIState),
2210 VMSTATE_UINT8(istat0, LSIState),
2211 VMSTATE_UINT8(istat1, LSIState),
2212 VMSTATE_UINT8(dcmd, LSIState),
2213 VMSTATE_UINT8(dstat, LSIState),
2214 VMSTATE_UINT8(dien, LSIState),
2215 VMSTATE_UINT8(sist0, LSIState),
2216 VMSTATE_UINT8(sist1, LSIState),
2217 VMSTATE_UINT8(sien0, LSIState),
2218 VMSTATE_UINT8(sien1, LSIState),
2219 VMSTATE_UINT8(mbox0, LSIState),
2220 VMSTATE_UINT8(mbox1, LSIState),
2221 VMSTATE_UINT8(dfifo, LSIState),
2222 VMSTATE_UINT8(ctest2, LSIState),
2223 VMSTATE_UINT8(ctest3, LSIState),
2224 VMSTATE_UINT8(ctest4, LSIState),
2225 VMSTATE_UINT8(ctest5, LSIState),
2226 VMSTATE_UINT8(ccntl0, LSIState),
2227 VMSTATE_UINT8(ccntl1, LSIState),
2228 VMSTATE_UINT32(dsp, LSIState),
2229 VMSTATE_UINT32(dsps, LSIState),
2230 VMSTATE_UINT8(dmode, LSIState),
2231 VMSTATE_UINT8(dcntl, LSIState),
2232 VMSTATE_UINT8(scntl0, LSIState),
2233 VMSTATE_UINT8(scntl1, LSIState),
2234 VMSTATE_UINT8(scntl2, LSIState),
2235 VMSTATE_UINT8(scntl3, LSIState),
2236 VMSTATE_UINT8(sstat0, LSIState),
2237 VMSTATE_UINT8(sstat1, LSIState),
2238 VMSTATE_UINT8(scid, LSIState),
2239 VMSTATE_UINT8(sxfer, LSIState),
2240 VMSTATE_UINT8(socl, LSIState),
2241 VMSTATE_UINT8(sdid, LSIState),
2242 VMSTATE_UINT8(ssid, LSIState),
2243 VMSTATE_UINT8(sfbr, LSIState),
2244 VMSTATE_UINT8(stest1, LSIState),
2245 VMSTATE_UINT8(stest2, LSIState),
2246 VMSTATE_UINT8(stest3, LSIState),
2247 VMSTATE_UINT8(sidl, LSIState),
2248 VMSTATE_UINT8(stime0, LSIState),
2249 VMSTATE_UINT8(respid0, LSIState),
2250 VMSTATE_UINT8(respid1, LSIState),
2251 VMSTATE_UINT8_V(sbcl, LSIState, 1),
2252 VMSTATE_UINT32(mmrs, LSIState),
2253 VMSTATE_UINT32(mmws, LSIState),
2254 VMSTATE_UINT32(sfs, LSIState),
2255 VMSTATE_UINT32(drs, LSIState),
2256 VMSTATE_UINT32(sbms, LSIState),
2257 VMSTATE_UINT32(dbms, LSIState),
2258 VMSTATE_UINT32(dnad64, LSIState),
2259 VMSTATE_UINT32(pmjad1, LSIState),
2260 VMSTATE_UINT32(pmjad2, LSIState),
2261 VMSTATE_UINT32(rbc, LSIState),
2262 VMSTATE_UINT32(ua, LSIState),
2263 VMSTATE_UINT32(ia, LSIState),
2264 VMSTATE_UINT32(sbc, LSIState),
2265 VMSTATE_UINT32(csbc, LSIState),
2266 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2267 VMSTATE_UINT8(sbr, LSIState),
2268
2269 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 8192),
2270 VMSTATE_END_OF_LIST()
2271 }
2272 };
2273
2274 static const struct SCSIBusInfo lsi_scsi_info = {
2275 .tcq = true,
2276 .max_target = LSI_MAX_DEVS,
2277 .max_lun = 0, /* LUN support is buggy */
2278
2279 .transfer_data = lsi_transfer_data,
2280 .complete = lsi_command_complete,
2281 .cancel = lsi_request_cancelled
2282 };
2283
2284 static void lsi_scsi_realize(PCIDevice *dev, Error **errp)
2285 {
2286 LSIState *s = LSI53C895A(dev);
2287 DeviceState *d = DEVICE(dev);
2288 uint8_t *pci_conf;
2289
2290 pci_conf = dev->config;
2291
2292 /* PCI latency timer = 255 */
2293 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2294 /* Interrupt pin A */
2295 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2296
2297 memory_region_init_io(&s->mmio_io, OBJECT(s), &lsi_mmio_ops, s,
2298 "lsi-mmio", 0x400);
2299 memory_region_init_io(&s->ram_io, OBJECT(s), &lsi_ram_ops, s,
2300 "lsi-ram", 0x2000);
2301 memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s,
2302 "lsi-io", 256);
2303
2304 address_space_init(&s->pci_io_as, pci_address_space_io(dev), "lsi-pci-io");
2305 qdev_init_gpio_out(d, &s->ext_irq, 1);
2306
2307 pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2308 pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mmio_io);
2309 pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
2310 QTAILQ_INIT(&s->queue);
2311
2312 scsi_bus_new(&s->bus, sizeof(s->bus), d, &lsi_scsi_info, NULL);
2313 }
2314
2315 static void lsi_scsi_exit(PCIDevice *dev)
2316 {
2317 LSIState *s = LSI53C895A(dev);
2318
2319 address_space_destroy(&s->pci_io_as);
2320 }
2321
2322 static void lsi_class_init(ObjectClass *klass, void *data)
2323 {
2324 DeviceClass *dc = DEVICE_CLASS(klass);
2325 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2326
2327 k->realize = lsi_scsi_realize;
2328 k->exit = lsi_scsi_exit;
2329 k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2330 k->device_id = PCI_DEVICE_ID_LSI_53C895A;
2331 k->class_id = PCI_CLASS_STORAGE_SCSI;
2332 k->subsystem_id = 0x1000;
2333 dc->reset = lsi_scsi_reset;
2334 dc->vmsd = &vmstate_lsi_scsi;
2335 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2336 }
2337
2338 static const TypeInfo lsi_info = {
2339 .name = TYPE_LSI53C895A,
2340 .parent = TYPE_PCI_DEVICE,
2341 .instance_size = sizeof(LSIState),
2342 .class_init = lsi_class_init,
2343 .interfaces = (InterfaceInfo[]) {
2344 { INTERFACE_CONVENTIONAL_PCI_DEVICE },
2345 { },
2346 },
2347 };
2348
2349 static void lsi53c810_class_init(ObjectClass *klass, void *data)
2350 {
2351 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2352
2353 k->device_id = PCI_DEVICE_ID_LSI_53C810;
2354 }
2355
2356 static TypeInfo lsi53c810_info = {
2357 .name = TYPE_LSI53C810,
2358 .parent = TYPE_LSI53C895A,
2359 .class_init = lsi53c810_class_init,
2360 };
2361
2362 static void lsi53c895a_register_types(void)
2363 {
2364 type_register_static(&lsi_info);
2365 type_register_static(&lsi53c810_info);
2366 }
2367
2368 type_init(lsi53c895a_register_types)
2369
2370 void lsi53c8xx_handle_legacy_cmdline(DeviceState *lsi_dev)
2371 {
2372 LSIState *s = LSI53C895A(lsi_dev);
2373
2374 scsi_bus_legacy_handle_cmdline(&s->bus);
2375 }
armbru's QEMU hackery