?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
main: switch qemu_set_fd_handler to g_io_add_watch
[qemu.git] / hw / lsi53c895a.c
blob1643a63ee835169ea3d9514ee13db4482bf1166a
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licensed under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h>
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18 #include "block_int.h"
19
20 //#define DEBUG_LSI
21 //#define DEBUG_LSI_REG
22
23 #ifdef DEBUG_LSI
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
28 #else
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
32 #endif
33
34 #define LSI_MAX_DEVS 7
35
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
41
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
50
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
59
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
68
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
72
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
81
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
90
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
95
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
104
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
112
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
121
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
128
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
137
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
144
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
150
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
156
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
159
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
161
162 #define PHASE_DO 0
163 #define PHASE_DI 1
164 #define PHASE_CMD 2
165 #define PHASE_ST 3
166 #define PHASE_MO 6
167 #define PHASE_MI 7
168 #define PHASE_MASK 7
169
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
172
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
175
176 typedef struct lsi_request {
177 SCSIRequest *req;
178 uint32_t tag;
179 uint32_t dma_len;
180 uint8_t *dma_buf;
181 uint32_t pending;
182 int out;
183 QTAILQ_ENTRY(lsi_request) next;
184 } lsi_request;
185
186 typedef struct {
187 PCIDevice dev;
188 MemoryRegion mmio_io;
189 MemoryRegion ram_io;
190 MemoryRegion io_io;
191
192 int carry; /* ??? Should this be an a visible register somewhere? */
193 int status;
194 /* Action to take at the end of a MSG IN phase.
195 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
196 int msg_action;
197 int msg_len;
198 uint8_t msg[LSI_MAX_MSGIN_LEN];
199 /* 0 if SCRIPTS are running or stopped.
200 * 1 if a Wait Reselect instruction has been issued.
201 * 2 if processing DMA from lsi_execute_script.
202 * 3 if a DMA operation is in progress. */
203 int waiting;
204 SCSIBus bus;
205 int current_lun;
206 /* The tag is a combination of the device ID and the SCSI tag. */
207 uint32_t select_tag;
208 int command_complete;
209 QTAILQ_HEAD(, lsi_request) queue;
210 lsi_request *current;
211
212 uint32_t dsa;
213 uint32_t temp;
214 uint32_t dnad;
215 uint32_t dbc;
216 uint8_t istat0;
217 uint8_t istat1;
218 uint8_t dcmd;
219 uint8_t dstat;
220 uint8_t dien;
221 uint8_t sist0;
222 uint8_t sist1;
223 uint8_t sien0;
224 uint8_t sien1;
225 uint8_t mbox0;
226 uint8_t mbox1;
227 uint8_t dfifo;
228 uint8_t ctest2;
229 uint8_t ctest3;
230 uint8_t ctest4;
231 uint8_t ctest5;
232 uint8_t ccntl0;
233 uint8_t ccntl1;
234 uint32_t dsp;
235 uint32_t dsps;
236 uint8_t dmode;
237 uint8_t dcntl;
238 uint8_t scntl0;
239 uint8_t scntl1;
240 uint8_t scntl2;
241 uint8_t scntl3;
242 uint8_t sstat0;
243 uint8_t sstat1;
244 uint8_t scid;
245 uint8_t sxfer;
246 uint8_t socl;
247 uint8_t sdid;
248 uint8_t ssid;
249 uint8_t sfbr;
250 uint8_t stest1;
251 uint8_t stest2;
252 uint8_t stest3;
253 uint8_t sidl;
254 uint8_t stime0;
255 uint8_t respid0;
256 uint8_t respid1;
257 uint32_t mmrs;
258 uint32_t mmws;
259 uint32_t sfs;
260 uint32_t drs;
261 uint32_t sbms;
262 uint32_t dbms;
263 uint32_t dnad64;
264 uint32_t pmjad1;
265 uint32_t pmjad2;
266 uint32_t rbc;
267 uint32_t ua;
268 uint32_t ia;
269 uint32_t sbc;
270 uint32_t csbc;
271 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
272 uint8_t sbr;
273
274 /* Script ram is stored as 32-bit words in host byteorder. */
275 uint32_t script_ram[2048];
276 } LSIState;
277
278 static inline int lsi_irq_on_rsl(LSIState *s)
279 {
280 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
281 }
282
283 static void lsi_soft_reset(LSIState *s)
284 {
285 lsi_request *p;
286
287 DPRINTF("Reset\n");
288 s->carry = 0;
289
290 s->msg_action = 0;
291 s->msg_len = 0;
292 s->waiting = 0;
293 s->dsa = 0;
294 s->dnad = 0;
295 s->dbc = 0;
296 s->temp = 0;
297 memset(s->scratch, 0, sizeof(s->scratch));
298 s->istat0 = 0;
299 s->istat1 = 0;
300 s->dcmd = 0x40;
301 s->dstat = LSI_DSTAT_DFE;
302 s->dien = 0;
303 s->sist0 = 0;
304 s->sist1 = 0;
305 s->sien0 = 0;
306 s->sien1 = 0;
307 s->mbox0 = 0;
308 s->mbox1 = 0;
309 s->dfifo = 0;
310 s->ctest2 = LSI_CTEST2_DACK;
311 s->ctest3 = 0;
312 s->ctest4 = 0;
313 s->ctest5 = 0;
314 s->ccntl0 = 0;
315 s->ccntl1 = 0;
316 s->dsp = 0;
317 s->dsps = 0;
318 s->dmode = 0;
319 s->dcntl = 0;
320 s->scntl0 = 0xc0;
321 s->scntl1 = 0;
322 s->scntl2 = 0;
323 s->scntl3 = 0;
324 s->sstat0 = 0;
325 s->sstat1 = 0;
326 s->scid = 7;
327 s->sxfer = 0;
328 s->socl = 0;
329 s->sdid = 0;
330 s->ssid = 0;
331 s->stest1 = 0;
332 s->stest2 = 0;
333 s->stest3 = 0;
334 s->sidl = 0;
335 s->stime0 = 0;
336 s->respid0 = 0x80;
337 s->respid1 = 0;
338 s->mmrs = 0;
339 s->mmws = 0;
340 s->sfs = 0;
341 s->drs = 0;
342 s->sbms = 0;
343 s->dbms = 0;
344 s->dnad64 = 0;
345 s->pmjad1 = 0;
346 s->pmjad2 = 0;
347 s->rbc = 0;
348 s->ua = 0;
349 s->ia = 0;
350 s->sbc = 0;
351 s->csbc = 0;
352 s->sbr = 0;
353 while (!QTAILQ_EMPTY(&s->queue)) {
354 p = QTAILQ_FIRST(&s->queue);
355 QTAILQ_REMOVE(&s->queue, p, next);
356 g_free(p);
357 }
358 if (s->current) {
359 g_free(s->current);
360 s->current = NULL;
361 }
362 }
363
364 static int lsi_dma_40bit(LSIState *s)
365 {
366 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
367 return 1;
368 return 0;
369 }
370
371 static int lsi_dma_ti64bit(LSIState *s)
372 {
373 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
374 return 1;
375 return 0;
376 }
377
378 static int lsi_dma_64bit(LSIState *s)
379 {
380 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
381 return 1;
382 return 0;
383 }
384
385 static uint8_t lsi_reg_readb(LSIState *s, int offset);
386 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
387 static void lsi_execute_script(LSIState *s);
388 static void lsi_reselect(LSIState *s, lsi_request *p);
389
390 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
391 {
392 uint32_t buf;
393
394 /* XXX: an optimization here used to fast-path the read from scripts
395 * memory. But that bypasses any iommu.
396 */
397 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
398 return cpu_to_le32(buf);
399 }
400
401 static void lsi_stop_script(LSIState *s)
402 {
403 s->istat1 &= ~LSI_ISTAT1_SRUN;
404 }
405
406 static void lsi_update_irq(LSIState *s)
407 {
408 int level;
409 static int last_level;
410 lsi_request *p;
411
412 /* It's unclear whether the DIP/SIP bits should be cleared when the
413 Interrupt Status Registers are cleared or when istat0 is read.
414 We currently do the formwer, which seems to work. */
415 level = 0;
416 if (s->dstat) {
417 if (s->dstat & s->dien)
418 level = 1;
419 s->istat0 |= LSI_ISTAT0_DIP;
420 } else {
421 s->istat0 &= ~LSI_ISTAT0_DIP;
422 }
423
424 if (s->sist0 || s->sist1) {
425 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
426 level = 1;
427 s->istat0 |= LSI_ISTAT0_SIP;
428 } else {
429 s->istat0 &= ~LSI_ISTAT0_SIP;
430 }
431 if (s->istat0 & LSI_ISTAT0_INTF)
432 level = 1;
433
434 if (level != last_level) {
435 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
436 level, s->dstat, s->sist1, s->sist0);
437 last_level = level;
438 }
439 qemu_set_irq(s->dev.irq[0], level);
440
441 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
442 DPRINTF("Handled IRQs & disconnected, looking for pending "
443 "processes\n");
444 QTAILQ_FOREACH(p, &s->queue, next) {
445 if (p->pending) {
446 lsi_reselect(s, p);
447 break;
448 }
449 }
450 }
451 }
452
453 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
454 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
455 {
456 uint32_t mask0;
457 uint32_t mask1;
458
459 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
460 stat1, stat0, s->sist1, s->sist0);
461 s->sist0 |= stat0;
462 s->sist1 |= stat1;
463 /* Stop processor on fatal or unmasked interrupt. As a special hack
464 we don't stop processing when raising STO. Instead continue
465 execution and stop at the next insn that accesses the SCSI bus. */
466 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
467 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
468 mask1 &= ~LSI_SIST1_STO;
469 if (s->sist0 & mask0 || s->sist1 & mask1) {
470 lsi_stop_script(s);
471 }
472 lsi_update_irq(s);
473 }
474
475 /* Stop SCRIPTS execution and raise a DMA interrupt. */
476 static void lsi_script_dma_interrupt(LSIState *s, int stat)
477 {
478 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
479 s->dstat |= stat;
480 lsi_update_irq(s);
481 lsi_stop_script(s);
482 }
483
484 static inline void lsi_set_phase(LSIState *s, int phase)
485 {
486 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
487 }
488
489 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
490 {
491 /* Trigger a phase mismatch. */
492 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
493 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
494 s->dsp = out ? s->pmjad1 : s->pmjad2;
495 } else {
496 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
497 }
498 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
499 } else {
500 DPRINTF("Phase mismatch interrupt\n");
501 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
502 lsi_stop_script(s);
503 }
504 lsi_set_phase(s, new_phase);
505 }
506
507
508 /* Resume SCRIPTS execution after a DMA operation. */
509 static void lsi_resume_script(LSIState *s)
510 {
511 if (s->waiting != 2) {
512 s->waiting = 0;
513 lsi_execute_script(s);
514 } else {
515 s->waiting = 0;
516 }
517 }
518
519 static void lsi_disconnect(LSIState *s)
520 {
521 s->scntl1 &= ~LSI_SCNTL1_CON;
522 s->sstat1 &= ~PHASE_MASK;
523 }
524
525 static void lsi_bad_selection(LSIState *s, uint32_t id)
526 {
527 DPRINTF("Selected absent target %d\n", id);
528 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
529 lsi_disconnect(s);
530 }
531
532 /* Initiate a SCSI layer data transfer. */
533 static void lsi_do_dma(LSIState *s, int out)
534 {
535 uint32_t count, id;
536 target_phys_addr_t addr;
537 SCSIDevice *dev;
538
539 assert(s->current);
540 if (!s->current->dma_len) {
541 /* Wait until data is available. */
542 DPRINTF("DMA no data available\n");
543 return;
544 }
545
546 id = (s->current->tag >> 8) & 0xf;
547 dev = s->bus.devs[id];
548 if (!dev) {
549 lsi_bad_selection(s, id);
550 return;
551 }
552
553 count = s->dbc;
554 if (count > s->current->dma_len)
555 count = s->current->dma_len;
556
557 addr = s->dnad;
558 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
559 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
560 addr |= ((uint64_t)s->dnad64 << 32);
561 else if (s->dbms)
562 addr |= ((uint64_t)s->dbms << 32);
563 else if (s->sbms)
564 addr |= ((uint64_t)s->sbms << 32);
565
566 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
567 s->csbc += count;
568 s->dnad += count;
569 s->dbc -= count;
570 if (s->current->dma_buf == NULL) {
571 s->current->dma_buf = scsi_req_get_buf(s->current->req);
572 }
573 /* ??? Set SFBR to first data byte. */
574 if (out) {
575 cpu_physical_memory_read(addr, s->current->dma_buf, count);
576 } else {
577 cpu_physical_memory_write(addr, s->current->dma_buf, count);
578 }
579 s->current->dma_len -= count;
580 if (s->current->dma_len == 0) {
581 s->current->dma_buf = NULL;
582 scsi_req_continue(s->current->req);
583 } else {
584 s->current->dma_buf += count;
585 lsi_resume_script(s);
586 }
587 }
588
589
590 /* Add a command to the queue. */
591 static void lsi_queue_command(LSIState *s)
592 {
593 lsi_request *p = s->current;
594
595 DPRINTF("Queueing tag=0x%x\n", p->tag);
596 assert(s->current != NULL);
597 assert(s->current->dma_len == 0);
598 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
599 s->current = NULL;
600
601 p->pending = 0;
602 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
603 }
604
605 /* Queue a byte for a MSG IN phase. */
606 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
607 {
608 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
609 BADF("MSG IN data too long\n");
610 } else {
611 DPRINTF("MSG IN 0x%02x\n", data);
612 s->msg[s->msg_len++] = data;
613 }
614 }
615
616 /* Perform reselection to continue a command. */
617 static void lsi_reselect(LSIState *s, lsi_request *p)
618 {
619 int id;
620
621 assert(s->current == NULL);
622 QTAILQ_REMOVE(&s->queue, p, next);
623 s->current = p;
624
625 id = (p->tag >> 8) & 0xf;
626 s->ssid = id | 0x80;
627 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
628 if (!(s->dcntl & LSI_DCNTL_COM)) {
629 s->sfbr = 1 << (id & 0x7);
630 }
631 DPRINTF("Reselected target %d\n", id);
632 s->scntl1 |= LSI_SCNTL1_CON;
633 lsi_set_phase(s, PHASE_MI);
634 s->msg_action = p->out ? 2 : 3;
635 s->current->dma_len = p->pending;
636 lsi_add_msg_byte(s, 0x80);
637 if (s->current->tag & LSI_TAG_VALID) {
638 lsi_add_msg_byte(s, 0x20);
639 lsi_add_msg_byte(s, p->tag & 0xff);
640 }
641
642 if (lsi_irq_on_rsl(s)) {
643 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
644 }
645 }
646
647 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
648 {
649 lsi_request *p;
650
651 QTAILQ_FOREACH(p, &s->queue, next) {
652 if (p->tag == tag) {
653 return p;
654 }
655 }
656
657 return NULL;
658 }
659
660 static void lsi_request_cancelled(SCSIRequest *req)
661 {
662 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
663 lsi_request *p = req->hba_private;
664
665 if (s->current && req == s->current->req) {
666 scsi_req_unref(req);
667 g_free(s->current);
668 s->current = NULL;
669 return;
670 }
671
672 if (p) {
673 QTAILQ_REMOVE(&s->queue, p, next);
674 scsi_req_unref(req);
675 g_free(p);
676 }
677 }
678
679 /* Record that data is available for a queued command. Returns zero if
680 the device was reselected, nonzero if the IO is deferred. */
681 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
682 {
683 lsi_request *p = req->hba_private;
684
685 if (p->pending) {
686 BADF("Multiple IO pending for request %p\n", p);
687 }
688 p->pending = len;
689 /* Reselect if waiting for it, or if reselection triggers an IRQ
690 and the bus is free.
691 Since no interrupt stacking is implemented in the emulation, it
692 is also required that there are no pending interrupts waiting
693 for service from the device driver. */
694 if (s->waiting == 1 ||
695 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
696 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
697 /* Reselect device. */
698 lsi_reselect(s, p);
699 return 0;
700 } else {
701 DPRINTF("Queueing IO tag=0x%x\n", tag);
702 p->pending = len;
703 return 1;
704 }
705 }
706
707 /* Callback to indicate that the SCSI layer has completed a command. */
708 static void lsi_command_complete(SCSIRequest *req, uint32_t status)
709 {
710 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
711 int out;
712
713 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
714 DPRINTF("Command complete status=%d\n", (int)status);
715 s->status = status;
716 s->command_complete = 2;
717 if (s->waiting && s->dbc != 0) {
718 /* Raise phase mismatch for short transfers. */
719 lsi_bad_phase(s, out, PHASE_ST);
720 } else {
721 lsi_set_phase(s, PHASE_ST);
722 }
723
724 if (s->current && req == s->current->req) {
725 scsi_req_unref(s->current->req);
726 g_free(s->current);
727 s->current = NULL;
728 }
729 lsi_resume_script(s);
730 }
731
732 /* Callback to indicate that the SCSI layer has completed a transfer. */
733 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
734 {
735 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
736 int out;
737
738 if (s->waiting == 1 || !s->current || req->hba_private != s->current ||
739 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
740 if (lsi_queue_req(s, req, len)) {
741 return;
742 }
743 }
744
745 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
746
747 /* host adapter (re)connected */
748 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
749 s->current->dma_len = len;
750 s->command_complete = 1;
751 if (s->waiting) {
752 if (s->waiting == 1 || s->dbc == 0) {
753 lsi_resume_script(s);
754 } else {
755 lsi_do_dma(s, out);
756 }
757 }
758 }
759
760 static void lsi_do_command(LSIState *s)
761 {
762 SCSIDevice *dev;
763 uint8_t buf[16];
764 uint32_t id;
765 int n;
766
767 DPRINTF("Send command len=%d\n", s->dbc);
768 if (s->dbc > 16)
769 s->dbc = 16;
770 cpu_physical_memory_read(s->dnad, buf, s->dbc);
771 s->sfbr = buf[0];
772 s->command_complete = 0;
773
774 id = (s->select_tag >> 8) & 0xf;
775 dev = s->bus.devs[id];
776 if (!dev) {
777 lsi_bad_selection(s, id);
778 return;
779 }
780
781 assert(s->current == NULL);
782 s->current = g_malloc0(sizeof(lsi_request));
783 s->current->tag = s->select_tag;
784 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
785 s->current);
786
787 n = scsi_req_enqueue(s->current->req);
788 if (n) {
789 if (n > 0) {
790 lsi_set_phase(s, PHASE_DI);
791 } else if (n < 0) {
792 lsi_set_phase(s, PHASE_DO);
793 }
794 scsi_req_continue(s->current->req);
795 }
796 if (!s->command_complete) {
797 if (n) {
798 /* Command did not complete immediately so disconnect. */
799 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
800 lsi_add_msg_byte(s, 4); /* DISCONNECT */
801 /* wait data */
802 lsi_set_phase(s, PHASE_MI);
803 s->msg_action = 1;
804 lsi_queue_command(s);
805 } else {
806 /* wait command complete */
807 lsi_set_phase(s, PHASE_DI);
808 }
809 }
810 }
811
812 static void lsi_do_status(LSIState *s)
813 {
814 uint8_t status;
815 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
816 if (s->dbc != 1)
817 BADF("Bad Status move\n");
818 s->dbc = 1;
819 status = s->status;
820 s->sfbr = status;
821 cpu_physical_memory_write(s->dnad, &status, 1);
822 lsi_set_phase(s, PHASE_MI);
823 s->msg_action = 1;
824 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
825 }
826
827 static void lsi_do_msgin(LSIState *s)
828 {
829 int len;
830 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
831 s->sfbr = s->msg[0];
832 len = s->msg_len;
833 if (len > s->dbc)
834 len = s->dbc;
835 cpu_physical_memory_write(s->dnad, s->msg, len);
836 /* Linux drivers rely on the last byte being in the SIDL. */
837 s->sidl = s->msg[len - 1];
838 s->msg_len -= len;
839 if (s->msg_len) {
840 memmove(s->msg, s->msg + len, s->msg_len);
841 } else {
842 /* ??? Check if ATN (not yet implemented) is asserted and maybe
843 switch to PHASE_MO. */
844 switch (s->msg_action) {
845 case 0:
846 lsi_set_phase(s, PHASE_CMD);
847 break;
848 case 1:
849 lsi_disconnect(s);
850 break;
851 case 2:
852 lsi_set_phase(s, PHASE_DO);
853 break;
854 case 3:
855 lsi_set_phase(s, PHASE_DI);
856 break;
857 default:
858 abort();
859 }
860 }
861 }
862
863 /* Read the next byte during a MSGOUT phase. */
864 static uint8_t lsi_get_msgbyte(LSIState *s)
865 {
866 uint8_t data;
867 cpu_physical_memory_read(s->dnad, &data, 1);
868 s->dnad++;
869 s->dbc--;
870 return data;
871 }
872
873 /* Skip the next n bytes during a MSGOUT phase. */
874 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
875 {
876 s->dnad += n;
877 s->dbc -= n;
878 }
879
880 static void lsi_do_msgout(LSIState *s)
881 {
882 uint8_t msg;
883 int len;
884 uint32_t current_tag;
885 lsi_request *current_req, *p, *p_next;
886 int id;
887
888 if (s->current) {
889 current_tag = s->current->tag;
890 current_req = s->current;
891 } else {
892 current_tag = s->select_tag;
893 current_req = lsi_find_by_tag(s, current_tag);
894 }
895 id = (current_tag >> 8) & 0xf;
896
897 DPRINTF("MSG out len=%d\n", s->dbc);
898 while (s->dbc) {
899 msg = lsi_get_msgbyte(s);
900 s->sfbr = msg;
901
902 switch (msg) {
903 case 0x04:
904 DPRINTF("MSG: Disconnect\n");
905 lsi_disconnect(s);
906 break;
907 case 0x08:
908 DPRINTF("MSG: No Operation\n");
909 lsi_set_phase(s, PHASE_CMD);
910 break;
911 case 0x01:
912 len = lsi_get_msgbyte(s);
913 msg = lsi_get_msgbyte(s);
914 (void)len; /* avoid a warning about unused variable*/
915 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
916 switch (msg) {
917 case 1:
918 DPRINTF("SDTR (ignored)\n");
919 lsi_skip_msgbytes(s, 2);
920 break;
921 case 3:
922 DPRINTF("WDTR (ignored)\n");
923 lsi_skip_msgbytes(s, 1);
924 break;
925 default:
926 goto bad;
927 }
928 break;
929 case 0x20: /* SIMPLE queue */
930 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
931 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
932 break;
933 case 0x21: /* HEAD of queue */
934 BADF("HEAD queue not implemented\n");
935 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
936 break;
937 case 0x22: /* ORDERED queue */
938 BADF("ORDERED queue not implemented\n");
939 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
940 break;
941 case 0x0d:
942 /* The ABORT TAG message clears the current I/O process only. */
943 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
944 if (current_req) {
945 scsi_req_cancel(current_req->req);
946 }
947 lsi_disconnect(s);
948 break;
949 case 0x06:
950 case 0x0e:
951 case 0x0c:
952 /* The ABORT message clears all I/O processes for the selecting
953 initiator on the specified logical unit of the target. */
954 if (msg == 0x06) {
955 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
956 }
957 /* The CLEAR QUEUE message clears all I/O processes for all
958 initiators on the specified logical unit of the target. */
959 if (msg == 0x0e) {
960 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
961 }
962 /* The BUS DEVICE RESET message clears all I/O processes for all
963 initiators on all logical units of the target. */
964 if (msg == 0x0c) {
965 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
966 }
967
968 /* clear the current I/O process */
969 if (s->current) {
970 scsi_req_cancel(s->current->req);
971 }
972
973 /* As the current implemented devices scsi_disk and scsi_generic
974 only support one LUN, we don't need to keep track of LUNs.
975 Clearing I/O processes for other initiators could be possible
976 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
977 device, but this is currently not implemented (and seems not
978 to be really necessary). So let's simply clear all queued
979 commands for the current device: */
980 id = current_tag & 0x0000ff00;
981 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
982 if ((p->tag & 0x0000ff00) == id) {
983 scsi_req_cancel(p->req);
984 }
985 }
986
987 lsi_disconnect(s);
988 break;
989 default:
990 if ((msg & 0x80) == 0) {
991 goto bad;
992 }
993 s->current_lun = msg & 7;
994 DPRINTF("Select LUN %d\n", s->current_lun);
995 lsi_set_phase(s, PHASE_CMD);
996 break;
997 }
998 }
999 return;
1000 bad:
1001 BADF("Unimplemented message 0x%02x\n", msg);
1002 lsi_set_phase(s, PHASE_MI);
1003 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
1004 s->msg_action = 0;
1005 }
1006
1007 /* Sign extend a 24-bit value. */
1008 static inline int32_t sxt24(int32_t n)
1009 {
1010 return (n << 8) >> 8;
1011 }
1012
1013 #define LSI_BUF_SIZE 4096
1014 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1015 {
1016 int n;
1017 uint8_t buf[LSI_BUF_SIZE];
1018
1019 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1020 while (count) {
1021 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1022 cpu_physical_memory_read(src, buf, n);
1023 cpu_physical_memory_write(dest, buf, n);
1024 src += n;
1025 dest += n;
1026 count -= n;
1027 }
1028 }
1029
1030 static void lsi_wait_reselect(LSIState *s)
1031 {
1032 lsi_request *p;
1033
1034 DPRINTF("Wait Reselect\n");
1035
1036 QTAILQ_FOREACH(p, &s->queue, next) {
1037 if (p->pending) {
1038 lsi_reselect(s, p);
1039 break;
1040 }
1041 }
1042 if (s->current == NULL) {
1043 s->waiting = 1;
1044 }
1045 }
1046
1047 static void lsi_execute_script(LSIState *s)
1048 {
1049 uint32_t insn;
1050 uint32_t addr, addr_high;
1051 int opcode;
1052 int insn_processed = 0;
1053
1054 s->istat1 |= LSI_ISTAT1_SRUN;
1055 again:
1056 insn_processed++;
1057 insn = read_dword(s, s->dsp);
1058 if (!insn) {
1059 /* If we receive an empty opcode increment the DSP by 4 bytes
1060 instead of 8 and execute the next opcode at that location */
1061 s->dsp += 4;
1062 goto again;
1063 }
1064 addr = read_dword(s, s->dsp + 4);
1065 addr_high = 0;
1066 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1067 s->dsps = addr;
1068 s->dcmd = insn >> 24;
1069 s->dsp += 8;
1070 switch (insn >> 30) {
1071 case 0: /* Block move. */
1072 if (s->sist1 & LSI_SIST1_STO) {
1073 DPRINTF("Delayed select timeout\n");
1074 lsi_stop_script(s);
1075 break;
1076 }
1077 s->dbc = insn & 0xffffff;
1078 s->rbc = s->dbc;
1079 /* ??? Set ESA. */
1080 s->ia = s->dsp - 8;
1081 if (insn & (1 << 29)) {
1082 /* Indirect addressing. */
1083 addr = read_dword(s, addr);
1084 } else if (insn & (1 << 28)) {
1085 uint32_t buf[2];
1086 int32_t offset;
1087 /* Table indirect addressing. */
1088
1089 /* 32-bit Table indirect */
1090 offset = sxt24(addr);
1091 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
1092 /* byte count is stored in bits 0:23 only */
1093 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1094 s->rbc = s->dbc;
1095 addr = cpu_to_le32(buf[1]);
1096
1097 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1098 * table, bits [31:24] */
1099 if (lsi_dma_40bit(s))
1100 addr_high = cpu_to_le32(buf[0]) >> 24;
1101 else if (lsi_dma_ti64bit(s)) {
1102 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1103 switch (selector) {
1104 case 0 ... 0x0f:
1105 /* offset index into scratch registers since
1106 * TI64 mode can use registers C to R */
1107 addr_high = s->scratch[2 + selector];
1108 break;
1109 case 0x10:
1110 addr_high = s->mmrs;
1111 break;
1112 case 0x11:
1113 addr_high = s->mmws;
1114 break;
1115 case 0x12:
1116 addr_high = s->sfs;
1117 break;
1118 case 0x13:
1119 addr_high = s->drs;
1120 break;
1121 case 0x14:
1122 addr_high = s->sbms;
1123 break;
1124 case 0x15:
1125 addr_high = s->dbms;
1126 break;
1127 default:
1128 BADF("Illegal selector specified (0x%x > 0x15)"
1129 " for 64-bit DMA block move", selector);
1130 break;
1131 }
1132 }
1133 } else if (lsi_dma_64bit(s)) {
1134 /* fetch a 3rd dword if 64-bit direct move is enabled and
1135 only if we're not doing table indirect or indirect addressing */
1136 s->dbms = read_dword(s, s->dsp);
1137 s->dsp += 4;
1138 s->ia = s->dsp - 12;
1139 }
1140 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1141 DPRINTF("Wrong phase got %d expected %d\n",
1142 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1143 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1144 break;
1145 }
1146 s->dnad = addr;
1147 s->dnad64 = addr_high;
1148 switch (s->sstat1 & 0x7) {
1149 case PHASE_DO:
1150 s->waiting = 2;
1151 lsi_do_dma(s, 1);
1152 if (s->waiting)
1153 s->waiting = 3;
1154 break;
1155 case PHASE_DI:
1156 s->waiting = 2;
1157 lsi_do_dma(s, 0);
1158 if (s->waiting)
1159 s->waiting = 3;
1160 break;
1161 case PHASE_CMD:
1162 lsi_do_command(s);
1163 break;
1164 case PHASE_ST:
1165 lsi_do_status(s);
1166 break;
1167 case PHASE_MO:
1168 lsi_do_msgout(s);
1169 break;
1170 case PHASE_MI:
1171 lsi_do_msgin(s);
1172 break;
1173 default:
1174 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1175 exit(1);
1176 }
1177 s->dfifo = s->dbc & 0xff;
1178 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1179 s->sbc = s->dbc;
1180 s->rbc -= s->dbc;
1181 s->ua = addr + s->dbc;
1182 break;
1183
1184 case 1: /* IO or Read/Write instruction. */
1185 opcode = (insn >> 27) & 7;
1186 if (opcode < 5) {
1187 uint32_t id;
1188
1189 if (insn & (1 << 25)) {
1190 id = read_dword(s, s->dsa + sxt24(insn));
1191 } else {
1192 id = insn;
1193 }
1194 id = (id >> 16) & 0xf;
1195 if (insn & (1 << 26)) {
1196 addr = s->dsp + sxt24(addr);
1197 }
1198 s->dnad = addr;
1199 switch (opcode) {
1200 case 0: /* Select */
1201 s->sdid = id;
1202 if (s->scntl1 & LSI_SCNTL1_CON) {
1203 DPRINTF("Already reselected, jumping to alternative address\n");
1204 s->dsp = s->dnad;
1205 break;
1206 }
1207 s->sstat0 |= LSI_SSTAT0_WOA;
1208 s->scntl1 &= ~LSI_SCNTL1_IARB;
1209 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1210 lsi_bad_selection(s, id);
1211 break;
1212 }
1213 DPRINTF("Selected target %d%s\n",
1214 id, insn & (1 << 3) ? " ATN" : "");
1215 /* ??? Linux drivers compain when this is set. Maybe
1216 it only applies in low-level mode (unimplemented).
1217 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1218 s->select_tag = id << 8;
1219 s->scntl1 |= LSI_SCNTL1_CON;
1220 if (insn & (1 << 3)) {
1221 s->socl |= LSI_SOCL_ATN;
1222 }
1223 lsi_set_phase(s, PHASE_MO);
1224 break;
1225 case 1: /* Disconnect */
1226 DPRINTF("Wait Disconnect\n");
1227 s->scntl1 &= ~LSI_SCNTL1_CON;
1228 break;
1229 case 2: /* Wait Reselect */
1230 if (!lsi_irq_on_rsl(s)) {
1231 lsi_wait_reselect(s);
1232 }
1233 break;
1234 case 3: /* Set */
1235 DPRINTF("Set%s%s%s%s\n",
1236 insn & (1 << 3) ? " ATN" : "",
1237 insn & (1 << 6) ? " ACK" : "",
1238 insn & (1 << 9) ? " TM" : "",
1239 insn & (1 << 10) ? " CC" : "");
1240 if (insn & (1 << 3)) {
1241 s->socl |= LSI_SOCL_ATN;
1242 lsi_set_phase(s, PHASE_MO);
1243 }
1244 if (insn & (1 << 9)) {
1245 BADF("Target mode not implemented\n");
1246 exit(1);
1247 }
1248 if (insn & (1 << 10))
1249 s->carry = 1;
1250 break;
1251 case 4: /* Clear */
1252 DPRINTF("Clear%s%s%s%s\n",
1253 insn & (1 << 3) ? " ATN" : "",
1254 insn & (1 << 6) ? " ACK" : "",
1255 insn & (1 << 9) ? " TM" : "",
1256 insn & (1 << 10) ? " CC" : "");
1257 if (insn & (1 << 3)) {
1258 s->socl &= ~LSI_SOCL_ATN;
1259 }
1260 if (insn & (1 << 10))
1261 s->carry = 0;
1262 break;
1263 }
1264 } else {
1265 uint8_t op0;
1266 uint8_t op1;
1267 uint8_t data8;
1268 int reg;
1269 int operator;
1270 #ifdef DEBUG_LSI
1271 static const char *opcode_names[3] =
1272 {"Write", "Read", "Read-Modify-Write"};
1273 static const char *operator_names[8] =
1274 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1275 #endif
1276
1277 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1278 data8 = (insn >> 8) & 0xff;
1279 opcode = (insn >> 27) & 7;
1280 operator = (insn >> 24) & 7;
1281 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1282 opcode_names[opcode - 5], reg,
1283 operator_names[operator], data8, s->sfbr,
1284 (insn & (1 << 23)) ? " SFBR" : "");
1285 op0 = op1 = 0;
1286 switch (opcode) {
1287 case 5: /* From SFBR */
1288 op0 = s->sfbr;
1289 op1 = data8;
1290 break;
1291 case 6: /* To SFBR */
1292 if (operator)
1293 op0 = lsi_reg_readb(s, reg);
1294 op1 = data8;
1295 break;
1296 case 7: /* Read-modify-write */
1297 if (operator)
1298 op0 = lsi_reg_readb(s, reg);
1299 if (insn & (1 << 23)) {
1300 op1 = s->sfbr;
1301 } else {
1302 op1 = data8;
1303 }
1304 break;
1305 }
1306
1307 switch (operator) {
1308 case 0: /* move */
1309 op0 = op1;
1310 break;
1311 case 1: /* Shift left */
1312 op1 = op0 >> 7;
1313 op0 = (op0 << 1) | s->carry;
1314 s->carry = op1;
1315 break;
1316 case 2: /* OR */
1317 op0 |= op1;
1318 break;
1319 case 3: /* XOR */
1320 op0 ^= op1;
1321 break;
1322 case 4: /* AND */
1323 op0 &= op1;
1324 break;
1325 case 5: /* SHR */
1326 op1 = op0 & 1;
1327 op0 = (op0 >> 1) | (s->carry << 7);
1328 s->carry = op1;
1329 break;
1330 case 6: /* ADD */
1331 op0 += op1;
1332 s->carry = op0 < op1;
1333 break;
1334 case 7: /* ADC */
1335 op0 += op1 + s->carry;
1336 if (s->carry)
1337 s->carry = op0 <= op1;
1338 else
1339 s->carry = op0 < op1;
1340 break;
1341 }
1342
1343 switch (opcode) {
1344 case 5: /* From SFBR */
1345 case 7: /* Read-modify-write */
1346 lsi_reg_writeb(s, reg, op0);
1347 break;
1348 case 6: /* To SFBR */
1349 s->sfbr = op0;
1350 break;
1351 }
1352 }
1353 break;
1354
1355 case 2: /* Transfer Control. */
1356 {
1357 int cond;
1358 int jmp;
1359
1360 if ((insn & 0x002e0000) == 0) {
1361 DPRINTF("NOP\n");
1362 break;
1363 }
1364 if (s->sist1 & LSI_SIST1_STO) {
1365 DPRINTF("Delayed select timeout\n");
1366 lsi_stop_script(s);
1367 break;
1368 }
1369 cond = jmp = (insn & (1 << 19)) != 0;
1370 if (cond == jmp && (insn & (1 << 21))) {
1371 DPRINTF("Compare carry %d\n", s->carry == jmp);
1372 cond = s->carry != 0;
1373 }
1374 if (cond == jmp && (insn & (1 << 17))) {
1375 DPRINTF("Compare phase %d %c= %d\n",
1376 (s->sstat1 & PHASE_MASK),
1377 jmp ? '=' : '!',
1378 ((insn >> 24) & 7));
1379 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1380 }
1381 if (cond == jmp && (insn & (1 << 18))) {
1382 uint8_t mask;
1383
1384 mask = (~insn >> 8) & 0xff;
1385 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1386 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1387 cond = (s->sfbr & mask) == (insn & mask);
1388 }
1389 if (cond == jmp) {
1390 if (insn & (1 << 23)) {
1391 /* Relative address. */
1392 addr = s->dsp + sxt24(addr);
1393 }
1394 switch ((insn >> 27) & 7) {
1395 case 0: /* Jump */
1396 DPRINTF("Jump to 0x%08x\n", addr);
1397 s->dsp = addr;
1398 break;
1399 case 1: /* Call */
1400 DPRINTF("Call 0x%08x\n", addr);
1401 s->temp = s->dsp;
1402 s->dsp = addr;
1403 break;
1404 case 2: /* Return */
1405 DPRINTF("Return to 0x%08x\n", s->temp);
1406 s->dsp = s->temp;
1407 break;
1408 case 3: /* Interrupt */
1409 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1410 if ((insn & (1 << 20)) != 0) {
1411 s->istat0 |= LSI_ISTAT0_INTF;
1412 lsi_update_irq(s);
1413 } else {
1414 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1415 }
1416 break;
1417 default:
1418 DPRINTF("Illegal transfer control\n");
1419 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1420 break;
1421 }
1422 } else {
1423 DPRINTF("Control condition failed\n");
1424 }
1425 }
1426 break;
1427
1428 case 3:
1429 if ((insn & (1 << 29)) == 0) {
1430 /* Memory move. */
1431 uint32_t dest;
1432 /* ??? The docs imply the destination address is loaded into
1433 the TEMP register. However the Linux drivers rely on
1434 the value being presrved. */
1435 dest = read_dword(s, s->dsp);
1436 s->dsp += 4;
1437 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1438 } else {
1439 uint8_t data[7];
1440 int reg;
1441 int n;
1442 int i;
1443
1444 if (insn & (1 << 28)) {
1445 addr = s->dsa + sxt24(addr);
1446 }
1447 n = (insn & 7);
1448 reg = (insn >> 16) & 0xff;
1449 if (insn & (1 << 24)) {
1450 cpu_physical_memory_read(addr, data, n);
1451 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1452 addr, *(int *)data);
1453 for (i = 0; i < n; i++) {
1454 lsi_reg_writeb(s, reg + i, data[i]);
1455 }
1456 } else {
1457 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1458 for (i = 0; i < n; i++) {
1459 data[i] = lsi_reg_readb(s, reg + i);
1460 }
1461 cpu_physical_memory_write(addr, data, n);
1462 }
1463 }
1464 }
1465 if (insn_processed > 10000 && !s->waiting) {
1466 /* Some windows drivers make the device spin waiting for a memory
1467 location to change. If we have been executed a lot of code then
1468 assume this is the case and force an unexpected device disconnect.
1469 This is apparently sufficient to beat the drivers into submission.
1470 */
1471 if (!(s->sien0 & LSI_SIST0_UDC))
1472 fprintf(stderr, "inf. loop with UDC masked\n");
1473 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1474 lsi_disconnect(s);
1475 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1476 if (s->dcntl & LSI_DCNTL_SSM) {
1477 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1478 } else {
1479 goto again;
1480 }
1481 }
1482 DPRINTF("SCRIPTS execution stopped\n");
1483 }
1484
1485 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1486 {
1487 uint8_t tmp;
1488 #define CASE_GET_REG24(name, addr) \
1489 case addr: return s->name & 0xff; \
1490 case addr + 1: return (s->name >> 8) & 0xff; \
1491 case addr + 2: return (s->name >> 16) & 0xff;
1492
1493 #define CASE_GET_REG32(name, addr) \
1494 case addr: return s->name & 0xff; \
1495 case addr + 1: return (s->name >> 8) & 0xff; \
1496 case addr + 2: return (s->name >> 16) & 0xff; \
1497 case addr + 3: return (s->name >> 24) & 0xff;
1498
1499 #ifdef DEBUG_LSI_REG
1500 DPRINTF("Read reg %x\n", offset);
1501 #endif
1502 switch (offset) {
1503 case 0x00: /* SCNTL0 */
1504 return s->scntl0;
1505 case 0x01: /* SCNTL1 */
1506 return s->scntl1;
1507 case 0x02: /* SCNTL2 */
1508 return s->scntl2;
1509 case 0x03: /* SCNTL3 */
1510 return s->scntl3;
1511 case 0x04: /* SCID */
1512 return s->scid;
1513 case 0x05: /* SXFER */
1514 return s->sxfer;
1515 case 0x06: /* SDID */
1516 return s->sdid;
1517 case 0x07: /* GPREG0 */
1518 return 0x7f;
1519 case 0x08: /* Revision ID */
1520 return 0x00;
1521 case 0xa: /* SSID */
1522 return s->ssid;
1523 case 0xb: /* SBCL */
1524 /* ??? This is not correct. However it's (hopefully) only
1525 used for diagnostics, so should be ok. */
1526 return 0;
1527 case 0xc: /* DSTAT */
1528 tmp = s->dstat | 0x80;
1529 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1530 s->dstat = 0;
1531 lsi_update_irq(s);
1532 return tmp;
1533 case 0x0d: /* SSTAT0 */
1534 return s->sstat0;
1535 case 0x0e: /* SSTAT1 */
1536 return s->sstat1;
1537 case 0x0f: /* SSTAT2 */
1538 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1539 CASE_GET_REG32(dsa, 0x10)
1540 case 0x14: /* ISTAT0 */
1541 return s->istat0;
1542 case 0x15: /* ISTAT1 */
1543 return s->istat1;
1544 case 0x16: /* MBOX0 */
1545 return s->mbox0;
1546 case 0x17: /* MBOX1 */
1547 return s->mbox1;
1548 case 0x18: /* CTEST0 */
1549 return 0xff;
1550 case 0x19: /* CTEST1 */
1551 return 0;
1552 case 0x1a: /* CTEST2 */
1553 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1554 if (s->istat0 & LSI_ISTAT0_SIGP) {
1555 s->istat0 &= ~LSI_ISTAT0_SIGP;
1556 tmp |= LSI_CTEST2_SIGP;
1557 }
1558 return tmp;
1559 case 0x1b: /* CTEST3 */
1560 return s->ctest3;
1561 CASE_GET_REG32(temp, 0x1c)
1562 case 0x20: /* DFIFO */
1563 return 0;
1564 case 0x21: /* CTEST4 */
1565 return s->ctest4;
1566 case 0x22: /* CTEST5 */
1567 return s->ctest5;
1568 case 0x23: /* CTEST6 */
1569 return 0;
1570 CASE_GET_REG24(dbc, 0x24)
1571 case 0x27: /* DCMD */
1572 return s->dcmd;
1573 CASE_GET_REG32(dnad, 0x28)
1574 CASE_GET_REG32(dsp, 0x2c)
1575 CASE_GET_REG32(dsps, 0x30)
1576 CASE_GET_REG32(scratch[0], 0x34)
1577 case 0x38: /* DMODE */
1578 return s->dmode;
1579 case 0x39: /* DIEN */
1580 return s->dien;
1581 case 0x3a: /* SBR */
1582 return s->sbr;
1583 case 0x3b: /* DCNTL */
1584 return s->dcntl;
1585 case 0x40: /* SIEN0 */
1586 return s->sien0;
1587 case 0x41: /* SIEN1 */
1588 return s->sien1;
1589 case 0x42: /* SIST0 */
1590 tmp = s->sist0;
1591 s->sist0 = 0;
1592 lsi_update_irq(s);
1593 return tmp;
1594 case 0x43: /* SIST1 */
1595 tmp = s->sist1;
1596 s->sist1 = 0;
1597 lsi_update_irq(s);
1598 return tmp;
1599 case 0x46: /* MACNTL */
1600 return 0x0f;
1601 case 0x47: /* GPCNTL0 */
1602 return 0x0f;
1603 case 0x48: /* STIME0 */
1604 return s->stime0;
1605 case 0x4a: /* RESPID0 */
1606 return s->respid0;
1607 case 0x4b: /* RESPID1 */
1608 return s->respid1;
1609 case 0x4d: /* STEST1 */
1610 return s->stest1;
1611 case 0x4e: /* STEST2 */
1612 return s->stest2;
1613 case 0x4f: /* STEST3 */
1614 return s->stest3;
1615 case 0x50: /* SIDL */
1616 /* This is needed by the linux drivers. We currently only update it
1617 during the MSG IN phase. */
1618 return s->sidl;
1619 case 0x52: /* STEST4 */
1620 return 0xe0;
1621 case 0x56: /* CCNTL0 */
1622 return s->ccntl0;
1623 case 0x57: /* CCNTL1 */
1624 return s->ccntl1;
1625 case 0x58: /* SBDL */
1626 /* Some drivers peek at the data bus during the MSG IN phase. */
1627 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1628 return s->msg[0];
1629 return 0;
1630 case 0x59: /* SBDL high */
1631 return 0;
1632 CASE_GET_REG32(mmrs, 0xa0)
1633 CASE_GET_REG32(mmws, 0xa4)
1634 CASE_GET_REG32(sfs, 0xa8)
1635 CASE_GET_REG32(drs, 0xac)
1636 CASE_GET_REG32(sbms, 0xb0)
1637 CASE_GET_REG32(dbms, 0xb4)
1638 CASE_GET_REG32(dnad64, 0xb8)
1639 CASE_GET_REG32(pmjad1, 0xc0)
1640 CASE_GET_REG32(pmjad2, 0xc4)
1641 CASE_GET_REG32(rbc, 0xc8)
1642 CASE_GET_REG32(ua, 0xcc)
1643 CASE_GET_REG32(ia, 0xd4)
1644 CASE_GET_REG32(sbc, 0xd8)
1645 CASE_GET_REG32(csbc, 0xdc)
1646 }
1647 if (offset >= 0x5c && offset < 0xa0) {
1648 int n;
1649 int shift;
1650 n = (offset - 0x58) >> 2;
1651 shift = (offset & 3) * 8;
1652 return (s->scratch[n] >> shift) & 0xff;
1653 }
1654 BADF("readb 0x%x\n", offset);
1655 exit(1);
1656 #undef CASE_GET_REG24
1657 #undef CASE_GET_REG32
1658 }
1659
1660 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1661 {
1662 #define CASE_SET_REG24(name, addr) \
1663 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1664 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1665 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1666
1667 #define CASE_SET_REG32(name, addr) \
1668 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1669 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1670 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1671 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1672
1673 #ifdef DEBUG_LSI_REG
1674 DPRINTF("Write reg %x = %02x\n", offset, val);
1675 #endif
1676 switch (offset) {
1677 case 0x00: /* SCNTL0 */
1678 s->scntl0 = val;
1679 if (val & LSI_SCNTL0_START) {
1680 BADF("Start sequence not implemented\n");
1681 }
1682 break;
1683 case 0x01: /* SCNTL1 */
1684 s->scntl1 = val & ~LSI_SCNTL1_SST;
1685 if (val & LSI_SCNTL1_IARB) {
1686 BADF("Immediate Arbritration not implemented\n");
1687 }
1688 if (val & LSI_SCNTL1_RST) {
1689 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1690 DeviceState *dev;
1691 int id;
1692
1693 for (id = 0; id < s->bus.ndev; id++) {
1694 if (s->bus.devs[id]) {
1695 dev = &s->bus.devs[id]->qdev;
1696 dev->info->reset(dev);
1697 }
1698 }
1699 s->sstat0 |= LSI_SSTAT0_RST;
1700 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1701 }
1702 } else {
1703 s->sstat0 &= ~LSI_SSTAT0_RST;
1704 }
1705 break;
1706 case 0x02: /* SCNTL2 */
1707 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1708 s->scntl2 = val;
1709 break;
1710 case 0x03: /* SCNTL3 */
1711 s->scntl3 = val;
1712 break;
1713 case 0x04: /* SCID */
1714 s->scid = val;
1715 break;
1716 case 0x05: /* SXFER */
1717 s->sxfer = val;
1718 break;
1719 case 0x06: /* SDID */
1720 if ((val & 0xf) != (s->ssid & 0xf))
1721 BADF("Destination ID does not match SSID\n");
1722 s->sdid = val & 0xf;
1723 break;
1724 case 0x07: /* GPREG0 */
1725 break;
1726 case 0x08: /* SFBR */
1727 /* The CPU is not allowed to write to this register. However the
1728 SCRIPTS register move instructions are. */
1729 s->sfbr = val;
1730 break;
1731 case 0x0a: case 0x0b:
1732 /* Openserver writes to these readonly registers on startup */
1733 return;
1734 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1735 /* Linux writes to these readonly registers on startup. */
1736 return;
1737 CASE_SET_REG32(dsa, 0x10)
1738 case 0x14: /* ISTAT0 */
1739 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1740 if (val & LSI_ISTAT0_ABRT) {
1741 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1742 }
1743 if (val & LSI_ISTAT0_INTF) {
1744 s->istat0 &= ~LSI_ISTAT0_INTF;
1745 lsi_update_irq(s);
1746 }
1747 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1748 DPRINTF("Woken by SIGP\n");
1749 s->waiting = 0;
1750 s->dsp = s->dnad;
1751 lsi_execute_script(s);
1752 }
1753 if (val & LSI_ISTAT0_SRST) {
1754 lsi_soft_reset(s);
1755 }
1756 break;
1757 case 0x16: /* MBOX0 */
1758 s->mbox0 = val;
1759 break;
1760 case 0x17: /* MBOX1 */
1761 s->mbox1 = val;
1762 break;
1763 case 0x1a: /* CTEST2 */
1764 s->ctest2 = val & LSI_CTEST2_PCICIE;
1765 break;
1766 case 0x1b: /* CTEST3 */
1767 s->ctest3 = val & 0x0f;
1768 break;
1769 CASE_SET_REG32(temp, 0x1c)
1770 case 0x21: /* CTEST4 */
1771 if (val & 7) {
1772 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1773 }
1774 s->ctest4 = val;
1775 break;
1776 case 0x22: /* CTEST5 */
1777 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1778 BADF("CTEST5 DMA increment not implemented\n");
1779 }
1780 s->ctest5 = val;
1781 break;
1782 CASE_SET_REG24(dbc, 0x24)
1783 CASE_SET_REG32(dnad, 0x28)
1784 case 0x2c: /* DSP[0:7] */
1785 s->dsp &= 0xffffff00;
1786 s->dsp |= val;
1787 break;
1788 case 0x2d: /* DSP[8:15] */
1789 s->dsp &= 0xffff00ff;
1790 s->dsp |= val << 8;
1791 break;
1792 case 0x2e: /* DSP[16:23] */
1793 s->dsp &= 0xff00ffff;
1794 s->dsp |= val << 16;
1795 break;
1796 case 0x2f: /* DSP[24:31] */
1797 s->dsp &= 0x00ffffff;
1798 s->dsp |= val << 24;
1799 if ((s->dmode & LSI_DMODE_MAN) == 0
1800 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1801 lsi_execute_script(s);
1802 break;
1803 CASE_SET_REG32(dsps, 0x30)
1804 CASE_SET_REG32(scratch[0], 0x34)
1805 case 0x38: /* DMODE */
1806 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1807 BADF("IO mappings not implemented\n");
1808 }
1809 s->dmode = val;
1810 break;
1811 case 0x39: /* DIEN */
1812 s->dien = val;
1813 lsi_update_irq(s);
1814 break;
1815 case 0x3a: /* SBR */
1816 s->sbr = val;
1817 break;
1818 case 0x3b: /* DCNTL */
1819 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1820 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1821 lsi_execute_script(s);
1822 break;
1823 case 0x40: /* SIEN0 */
1824 s->sien0 = val;
1825 lsi_update_irq(s);
1826 break;
1827 case 0x41: /* SIEN1 */
1828 s->sien1 = val;
1829 lsi_update_irq(s);
1830 break;
1831 case 0x47: /* GPCNTL0 */
1832 break;
1833 case 0x48: /* STIME0 */
1834 s->stime0 = val;
1835 break;
1836 case 0x49: /* STIME1 */
1837 if (val & 0xf) {
1838 DPRINTF("General purpose timer not implemented\n");
1839 /* ??? Raising the interrupt immediately seems to be sufficient
1840 to keep the FreeBSD driver happy. */
1841 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1842 }
1843 break;
1844 case 0x4a: /* RESPID0 */
1845 s->respid0 = val;
1846 break;
1847 case 0x4b: /* RESPID1 */
1848 s->respid1 = val;
1849 break;
1850 case 0x4d: /* STEST1 */
1851 s->stest1 = val;
1852 break;
1853 case 0x4e: /* STEST2 */
1854 if (val & 1) {
1855 BADF("Low level mode not implemented\n");
1856 }
1857 s->stest2 = val;
1858 break;
1859 case 0x4f: /* STEST3 */
1860 if (val & 0x41) {
1861 BADF("SCSI FIFO test mode not implemented\n");
1862 }
1863 s->stest3 = val;
1864 break;
1865 case 0x56: /* CCNTL0 */
1866 s->ccntl0 = val;
1867 break;
1868 case 0x57: /* CCNTL1 */
1869 s->ccntl1 = val;
1870 break;
1871 CASE_SET_REG32(mmrs, 0xa0)
1872 CASE_SET_REG32(mmws, 0xa4)
1873 CASE_SET_REG32(sfs, 0xa8)
1874 CASE_SET_REG32(drs, 0xac)
1875 CASE_SET_REG32(sbms, 0xb0)
1876 CASE_SET_REG32(dbms, 0xb4)
1877 CASE_SET_REG32(dnad64, 0xb8)
1878 CASE_SET_REG32(pmjad1, 0xc0)
1879 CASE_SET_REG32(pmjad2, 0xc4)
1880 CASE_SET_REG32(rbc, 0xc8)
1881 CASE_SET_REG32(ua, 0xcc)
1882 CASE_SET_REG32(ia, 0xd4)
1883 CASE_SET_REG32(sbc, 0xd8)
1884 CASE_SET_REG32(csbc, 0xdc)
1885 default:
1886 if (offset >= 0x5c && offset < 0xa0) {
1887 int n;
1888 int shift;
1889 n = (offset - 0x58) >> 2;
1890 shift = (offset & 3) * 8;
1891 s->scratch[n] &= ~(0xff << shift);
1892 s->scratch[n] |= (val & 0xff) << shift;
1893 } else {
1894 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1895 }
1896 }
1897 #undef CASE_SET_REG24
1898 #undef CASE_SET_REG32
1899 }
1900
1901 static void lsi_mmio_write(void *opaque, target_phys_addr_t addr,
1902 uint64_t val, unsigned size)
1903 {
1904 LSIState *s = opaque;
1905
1906 lsi_reg_writeb(s, addr & 0xff, val);
1907 }
1908
1909 static uint64_t lsi_mmio_read(void *opaque, target_phys_addr_t addr,
1910 unsigned size)
1911 {
1912 LSIState *s = opaque;
1913
1914 return lsi_reg_readb(s, addr & 0xff);
1915 }
1916
1917 static const MemoryRegionOps lsi_mmio_ops = {
1918 .read = lsi_mmio_read,
1919 .write = lsi_mmio_write,
1920 .endianness = DEVICE_NATIVE_ENDIAN,
1921 .impl = {
1922 .min_access_size = 1,
1923 .max_access_size = 1,
1924 },
1925 };
1926
1927 static void lsi_ram_write(void *opaque, target_phys_addr_t addr,
1928 uint64_t val, unsigned size)
1929 {
1930 LSIState *s = opaque;
1931 uint32_t newval;
1932 uint32_t mask;
1933 int shift;
1934
1935 newval = s->script_ram[addr >> 2];
1936 shift = (addr & 3) * 8;
1937 mask = ((uint64_t)1 << (size * 8)) - 1;
1938 newval &= ~(mask << shift);
1939 newval |= val << shift;
1940 s->script_ram[addr >> 2] = newval;
1941 }
1942
1943 static uint64_t lsi_ram_read(void *opaque, target_phys_addr_t addr,
1944 unsigned size)
1945 {
1946 LSIState *s = opaque;
1947 uint32_t val;
1948 uint32_t mask;
1949
1950 val = s->script_ram[addr >> 2];
1951 mask = ((uint64_t)1 << (size * 8)) - 1;
1952 val >>= (addr & 3) * 8;
1953 return val & mask;
1954 }
1955
1956 static const MemoryRegionOps lsi_ram_ops = {
1957 .read = lsi_ram_read,
1958 .write = lsi_ram_write,
1959 .endianness = DEVICE_NATIVE_ENDIAN,
1960 };
1961
1962 static uint64_t lsi_io_read(void *opaque, target_phys_addr_t addr,
1963 unsigned size)
1964 {
1965 LSIState *s = opaque;
1966 return lsi_reg_readb(s, addr & 0xff);
1967 }
1968
1969 static void lsi_io_write(void *opaque, target_phys_addr_t addr,
1970 uint64_t val, unsigned size)
1971 {
1972 LSIState *s = opaque;
1973 lsi_reg_writeb(s, addr & 0xff, val);
1974 }
1975
1976 static const MemoryRegionOps lsi_io_ops = {
1977 .read = lsi_io_read,
1978 .write = lsi_io_write,
1979 .endianness = DEVICE_NATIVE_ENDIAN,
1980 .impl = {
1981 .min_access_size = 1,
1982 .max_access_size = 1,
1983 },
1984 };
1985
1986 static void lsi_scsi_reset(DeviceState *dev)
1987 {
1988 LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
1989
1990 lsi_soft_reset(s);
1991 }
1992
1993 static void lsi_pre_save(void *opaque)
1994 {
1995 LSIState *s = opaque;
1996
1997 if (s->current) {
1998 assert(s->current->dma_buf == NULL);
1999 assert(s->current->dma_len == 0);
2000 }
2001 assert(QTAILQ_EMPTY(&s->queue));
2002 }
2003
2004 static const VMStateDescription vmstate_lsi_scsi = {
2005 .name = "lsiscsi",
2006 .version_id = 0,
2007 .minimum_version_id = 0,
2008 .minimum_version_id_old = 0,
2009 .pre_save = lsi_pre_save,
2010 .fields = (VMStateField []) {
2011 VMSTATE_PCI_DEVICE(dev, LSIState),
2012
2013 VMSTATE_INT32(carry, LSIState),
2014 VMSTATE_INT32(status, LSIState),
2015 VMSTATE_INT32(msg_action, LSIState),
2016 VMSTATE_INT32(msg_len, LSIState),
2017 VMSTATE_BUFFER(msg, LSIState),
2018 VMSTATE_INT32(waiting, LSIState),
2019
2020 VMSTATE_UINT32(dsa, LSIState),
2021 VMSTATE_UINT32(temp, LSIState),
2022 VMSTATE_UINT32(dnad, LSIState),
2023 VMSTATE_UINT32(dbc, LSIState),
2024 VMSTATE_UINT8(istat0, LSIState),
2025 VMSTATE_UINT8(istat1, LSIState),
2026 VMSTATE_UINT8(dcmd, LSIState),
2027 VMSTATE_UINT8(dstat, LSIState),
2028 VMSTATE_UINT8(dien, LSIState),
2029 VMSTATE_UINT8(sist0, LSIState),
2030 VMSTATE_UINT8(sist1, LSIState),
2031 VMSTATE_UINT8(sien0, LSIState),
2032 VMSTATE_UINT8(sien1, LSIState),
2033 VMSTATE_UINT8(mbox0, LSIState),
2034 VMSTATE_UINT8(mbox1, LSIState),
2035 VMSTATE_UINT8(dfifo, LSIState),
2036 VMSTATE_UINT8(ctest2, LSIState),
2037 VMSTATE_UINT8(ctest3, LSIState),
2038 VMSTATE_UINT8(ctest4, LSIState),
2039 VMSTATE_UINT8(ctest5, LSIState),
2040 VMSTATE_UINT8(ccntl0, LSIState),
2041 VMSTATE_UINT8(ccntl1, LSIState),
2042 VMSTATE_UINT32(dsp, LSIState),
2043 VMSTATE_UINT32(dsps, LSIState),
2044 VMSTATE_UINT8(dmode, LSIState),
2045 VMSTATE_UINT8(dcntl, LSIState),
2046 VMSTATE_UINT8(scntl0, LSIState),
2047 VMSTATE_UINT8(scntl1, LSIState),
2048 VMSTATE_UINT8(scntl2, LSIState),
2049 VMSTATE_UINT8(scntl3, LSIState),
2050 VMSTATE_UINT8(sstat0, LSIState),
2051 VMSTATE_UINT8(sstat1, LSIState),
2052 VMSTATE_UINT8(scid, LSIState),
2053 VMSTATE_UINT8(sxfer, LSIState),
2054 VMSTATE_UINT8(socl, LSIState),
2055 VMSTATE_UINT8(sdid, LSIState),
2056 VMSTATE_UINT8(ssid, LSIState),
2057 VMSTATE_UINT8(sfbr, LSIState),
2058 VMSTATE_UINT8(stest1, LSIState),
2059 VMSTATE_UINT8(stest2, LSIState),
2060 VMSTATE_UINT8(stest3, LSIState),
2061 VMSTATE_UINT8(sidl, LSIState),
2062 VMSTATE_UINT8(stime0, LSIState),
2063 VMSTATE_UINT8(respid0, LSIState),
2064 VMSTATE_UINT8(respid1, LSIState),
2065 VMSTATE_UINT32(mmrs, LSIState),
2066 VMSTATE_UINT32(mmws, LSIState),
2067 VMSTATE_UINT32(sfs, LSIState),
2068 VMSTATE_UINT32(drs, LSIState),
2069 VMSTATE_UINT32(sbms, LSIState),
2070 VMSTATE_UINT32(dbms, LSIState),
2071 VMSTATE_UINT32(dnad64, LSIState),
2072 VMSTATE_UINT32(pmjad1, LSIState),
2073 VMSTATE_UINT32(pmjad2, LSIState),
2074 VMSTATE_UINT32(rbc, LSIState),
2075 VMSTATE_UINT32(ua, LSIState),
2076 VMSTATE_UINT32(ia, LSIState),
2077 VMSTATE_UINT32(sbc, LSIState),
2078 VMSTATE_UINT32(csbc, LSIState),
2079 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2080 VMSTATE_UINT8(sbr, LSIState),
2081
2082 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2083 VMSTATE_END_OF_LIST()
2084 }
2085 };
2086
2087 static int lsi_scsi_uninit(PCIDevice *d)
2088 {
2089 LSIState *s = DO_UPCAST(LSIState, dev, d);
2090
2091 memory_region_destroy(&s->mmio_io);
2092 memory_region_destroy(&s->ram_io);
2093 memory_region_destroy(&s->io_io);
2094
2095 return 0;
2096 }
2097
2098 static const struct SCSIBusOps lsi_scsi_ops = {
2099 .transfer_data = lsi_transfer_data,
2100 .complete = lsi_command_complete,
2101 .cancel = lsi_request_cancelled
2102 };
2103
2104 static int lsi_scsi_init(PCIDevice *dev)
2105 {
2106 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2107 uint8_t *pci_conf;
2108
2109 pci_conf = s->dev.config;
2110
2111 /* PCI latency timer = 255 */
2112 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2113 /* TODO: RST# value should be 0 */
2114 /* Interrupt pin 1 */
2115 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2116
2117 memory_region_init_io(&s->mmio_io, &lsi_mmio_ops, s, "lsi-mmio", 0x400);
2118 memory_region_init_io(&s->ram_io, &lsi_ram_ops, s, "lsi-ram", 0x2000);
2119 memory_region_init_io(&s->io_io, &lsi_io_ops, s, "lsi-io", 256);
2120
2121 pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2122 pci_register_bar(&s->dev, 1, 0, &s->mmio_io);
2123 pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
2124 QTAILQ_INIT(&s->queue);
2125
2126 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, &lsi_scsi_ops);
2127 if (!dev->qdev.hotplugged) {
2128 return scsi_bus_legacy_handle_cmdline(&s->bus);
2129 }
2130 return 0;
2131 }
2132
2133 static PCIDeviceInfo lsi_info = {
2134 .qdev.name = "lsi53c895a",
2135 .qdev.alias = "lsi",
2136 .qdev.size = sizeof(LSIState),
2137 .qdev.reset = lsi_scsi_reset,
2138 .qdev.vmsd = &vmstate_lsi_scsi,
2139 .init = lsi_scsi_init,
2140 .exit = lsi_scsi_uninit,
2141 .vendor_id = PCI_VENDOR_ID_LSI_LOGIC,
2142 .device_id = PCI_DEVICE_ID_LSI_53C895A,
2143 .class_id = PCI_CLASS_STORAGE_SCSI,
2144 .subsystem_id = 0x1000,
2145 };
2146
2147 static void lsi53c895a_register_devices(void)
2148 {
2149 pci_qdev_register(&lsi_info);
2150 }
2151
2152 device_init(lsi53c895a_register_devices);
QEmu