?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
QMP: Introduce vm-info
[qemu.git] / hw / lsi53c895a.c
blob8b8a80b898bc82db35ef2c87c3fda7598eb241d1
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licenced under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h> \
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18 #include "block_int.h"
19
20 //#define DEBUG_LSI
21 //#define DEBUG_LSI_REG
22
23 #ifdef DEBUG_LSI
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
28 #else
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
32 #endif
33
34 #define LSI_MAX_DEVS 7
35
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
41
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
50
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
59
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
68
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
72
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
81
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
90
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
95
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
104
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
112
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
121
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
128
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
137
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
144
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
150
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
156
157 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
158
159 #define PHASE_DO 0
160 #define PHASE_DI 1
161 #define PHASE_CMD 2
162 #define PHASE_ST 3
163 #define PHASE_MO 6
164 #define PHASE_MI 7
165 #define PHASE_MASK 7
166
167 /* Maximum length of MSG IN data. */
168 #define LSI_MAX_MSGIN_LEN 8
169
170 /* Flag set if this is a tagged command. */
171 #define LSI_TAG_VALID (1 << 16)
172
173 typedef struct {
174 uint32_t tag;
175 uint32_t pending;
176 int out;
177 } lsi_queue;
178
179 typedef struct {
180 PCIDevice dev;
181 int mmio_io_addr;
182 int ram_io_addr;
183 uint32_t script_ram_base;
184
185 int carry; /* ??? Should this be an a visible register somewhere? */
186 int sense;
187 /* Action to take at the end of a MSG IN phase.
188 0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN. */
189 int msg_action;
190 int msg_len;
191 uint8_t msg[LSI_MAX_MSGIN_LEN];
192 /* 0 if SCRIPTS are running or stopped.
193 * 1 if a Wait Reselect instruction has been issued.
194 * 2 if processing DMA from lsi_execute_script.
195 * 3 if a DMA operation is in progress. */
196 int waiting;
197 SCSIBus bus;
198 SCSIDevice *current_dev;
199 int current_lun;
200 /* The tag is a combination of the device ID and the SCSI tag. */
201 uint32_t current_tag;
202 uint32_t current_dma_len;
203 int command_complete;
204 uint8_t *dma_buf;
205 lsi_queue *queue;
206 int queue_len;
207 int active_commands;
208
209 uint32_t dsa;
210 uint32_t temp;
211 uint32_t dnad;
212 uint32_t dbc;
213 uint8_t istat0;
214 uint8_t istat1;
215 uint8_t dcmd;
216 uint8_t dstat;
217 uint8_t dien;
218 uint8_t sist0;
219 uint8_t sist1;
220 uint8_t sien0;
221 uint8_t sien1;
222 uint8_t mbox0;
223 uint8_t mbox1;
224 uint8_t dfifo;
225 uint8_t ctest2;
226 uint8_t ctest3;
227 uint8_t ctest4;
228 uint8_t ctest5;
229 uint8_t ccntl0;
230 uint8_t ccntl1;
231 uint32_t dsp;
232 uint32_t dsps;
233 uint8_t dmode;
234 uint8_t dcntl;
235 uint8_t scntl0;
236 uint8_t scntl1;
237 uint8_t scntl2;
238 uint8_t scntl3;
239 uint8_t sstat0;
240 uint8_t sstat1;
241 uint8_t scid;
242 uint8_t sxfer;
243 uint8_t socl;
244 uint8_t sdid;
245 uint8_t ssid;
246 uint8_t sfbr;
247 uint8_t stest1;
248 uint8_t stest2;
249 uint8_t stest3;
250 uint8_t sidl;
251 uint8_t stime0;
252 uint8_t respid0;
253 uint8_t respid1;
254 uint32_t mmrs;
255 uint32_t mmws;
256 uint32_t sfs;
257 uint32_t drs;
258 uint32_t sbms;
259 uint32_t dbms;
260 uint32_t dnad64;
261 uint32_t pmjad1;
262 uint32_t pmjad2;
263 uint32_t rbc;
264 uint32_t ua;
265 uint32_t ia;
266 uint32_t sbc;
267 uint32_t csbc;
268 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
269 uint8_t sbr;
270
271 /* Script ram is stored as 32-bit words in host byteorder. */
272 uint32_t script_ram[2048];
273 } LSIState;
274
275 static void lsi_soft_reset(LSIState *s)
276 {
277 DPRINTF("Reset\n");
278 s->carry = 0;
279
280 s->waiting = 0;
281 s->dsa = 0;
282 s->dnad = 0;
283 s->dbc = 0;
284 s->temp = 0;
285 memset(s->scratch, 0, sizeof(s->scratch));
286 s->istat0 = 0;
287 s->istat1 = 0;
288 s->dcmd = 0;
289 s->dstat = 0;
290 s->dien = 0;
291 s->sist0 = 0;
292 s->sist1 = 0;
293 s->sien0 = 0;
294 s->sien1 = 0;
295 s->mbox0 = 0;
296 s->mbox1 = 0;
297 s->dfifo = 0;
298 s->ctest2 = 0;
299 s->ctest3 = 0;
300 s->ctest4 = 0;
301 s->ctest5 = 0;
302 s->ccntl0 = 0;
303 s->ccntl1 = 0;
304 s->dsp = 0;
305 s->dsps = 0;
306 s->dmode = 0;
307 s->dcntl = 0;
308 s->scntl0 = 0xc0;
309 s->scntl1 = 0;
310 s->scntl2 = 0;
311 s->scntl3 = 0;
312 s->sstat0 = 0;
313 s->sstat1 = 0;
314 s->scid = 7;
315 s->sxfer = 0;
316 s->socl = 0;
317 s->stest1 = 0;
318 s->stest2 = 0;
319 s->stest3 = 0;
320 s->sidl = 0;
321 s->stime0 = 0;
322 s->respid0 = 0x80;
323 s->respid1 = 0;
324 s->mmrs = 0;
325 s->mmws = 0;
326 s->sfs = 0;
327 s->drs = 0;
328 s->sbms = 0;
329 s->dbms = 0;
330 s->dnad64 = 0;
331 s->pmjad1 = 0;
332 s->pmjad2 = 0;
333 s->rbc = 0;
334 s->ua = 0;
335 s->ia = 0;
336 s->sbc = 0;
337 s->csbc = 0;
338 s->sbr = 0;
339 }
340
341 static int lsi_dma_40bit(LSIState *s)
342 {
343 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
344 return 1;
345 return 0;
346 }
347
348 static int lsi_dma_ti64bit(LSIState *s)
349 {
350 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
351 return 1;
352 return 0;
353 }
354
355 static int lsi_dma_64bit(LSIState *s)
356 {
357 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
358 return 1;
359 return 0;
360 }
361
362 static uint8_t lsi_reg_readb(LSIState *s, int offset);
363 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
364 static void lsi_execute_script(LSIState *s);
365
366 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
367 {
368 uint32_t buf;
369
370 /* Optimize reading from SCRIPTS RAM. */
371 if ((addr & 0xffffe000) == s->script_ram_base) {
372 return s->script_ram[(addr & 0x1fff) >> 2];
373 }
374 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
375 return cpu_to_le32(buf);
376 }
377
378 static void lsi_stop_script(LSIState *s)
379 {
380 s->istat1 &= ~LSI_ISTAT1_SRUN;
381 }
382
383 static void lsi_update_irq(LSIState *s)
384 {
385 int level;
386 static int last_level;
387
388 /* It's unclear whether the DIP/SIP bits should be cleared when the
389 Interrupt Status Registers are cleared or when istat0 is read.
390 We currently do the formwer, which seems to work. */
391 level = 0;
392 if (s->dstat) {
393 if (s->dstat & s->dien)
394 level = 1;
395 s->istat0 |= LSI_ISTAT0_DIP;
396 } else {
397 s->istat0 &= ~LSI_ISTAT0_DIP;
398 }
399
400 if (s->sist0 || s->sist1) {
401 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
402 level = 1;
403 s->istat0 |= LSI_ISTAT0_SIP;
404 } else {
405 s->istat0 &= ~LSI_ISTAT0_SIP;
406 }
407 if (s->istat0 & LSI_ISTAT0_INTF)
408 level = 1;
409
410 if (level != last_level) {
411 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
412 level, s->dstat, s->sist1, s->sist0);
413 last_level = level;
414 }
415 qemu_set_irq(s->dev.irq[0], level);
416 }
417
418 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
419 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
420 {
421 uint32_t mask0;
422 uint32_t mask1;
423
424 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
425 stat1, stat0, s->sist1, s->sist0);
426 s->sist0 |= stat0;
427 s->sist1 |= stat1;
428 /* Stop processor on fatal or unmasked interrupt. As a special hack
429 we don't stop processing when raising STO. Instead continue
430 execution and stop at the next insn that accesses the SCSI bus. */
431 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
432 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
433 mask1 &= ~LSI_SIST1_STO;
434 if (s->sist0 & mask0 || s->sist1 & mask1) {
435 lsi_stop_script(s);
436 }
437 lsi_update_irq(s);
438 }
439
440 /* Stop SCRIPTS execution and raise a DMA interrupt. */
441 static void lsi_script_dma_interrupt(LSIState *s, int stat)
442 {
443 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
444 s->dstat |= stat;
445 lsi_update_irq(s);
446 lsi_stop_script(s);
447 }
448
449 static inline void lsi_set_phase(LSIState *s, int phase)
450 {
451 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
452 }
453
454 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
455 {
456 /* Trigger a phase mismatch. */
457 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
458 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
459 s->dsp = s->pmjad1;
460 } else {
461 s->dsp = s->pmjad2;
462 }
463 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
464 } else {
465 DPRINTF("Phase mismatch interrupt\n");
466 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
467 lsi_stop_script(s);
468 }
469 lsi_set_phase(s, new_phase);
470 }
471
472
473 /* Resume SCRIPTS execution after a DMA operation. */
474 static void lsi_resume_script(LSIState *s)
475 {
476 if (s->waiting != 2) {
477 s->waiting = 0;
478 lsi_execute_script(s);
479 } else {
480 s->waiting = 0;
481 }
482 }
483
484 /* Initiate a SCSI layer data transfer. */
485 static void lsi_do_dma(LSIState *s, int out)
486 {
487 uint32_t count;
488 target_phys_addr_t addr;
489
490 if (!s->current_dma_len) {
491 /* Wait until data is available. */
492 DPRINTF("DMA no data available\n");
493 return;
494 }
495
496 count = s->dbc;
497 if (count > s->current_dma_len)
498 count = s->current_dma_len;
499
500 addr = s->dnad;
501 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
502 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
503 addr |= ((uint64_t)s->dnad64 << 32);
504 else if (s->dbms)
505 addr |= ((uint64_t)s->dbms << 32);
506 else if (s->sbms)
507 addr |= ((uint64_t)s->sbms << 32);
508
509 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
510 s->csbc += count;
511 s->dnad += count;
512 s->dbc -= count;
513
514 if (s->dma_buf == NULL) {
515 s->dma_buf = s->current_dev->info->get_buf(s->current_dev,
516 s->current_tag);
517 }
518
519 /* ??? Set SFBR to first data byte. */
520 if (out) {
521 cpu_physical_memory_read(addr, s->dma_buf, count);
522 } else {
523 cpu_physical_memory_write(addr, s->dma_buf, count);
524 }
525 s->current_dma_len -= count;
526 if (s->current_dma_len == 0) {
527 s->dma_buf = NULL;
528 if (out) {
529 /* Write the data. */
530 s->current_dev->info->write_data(s->current_dev, s->current_tag);
531 } else {
532 /* Request any remaining data. */
533 s->current_dev->info->read_data(s->current_dev, s->current_tag);
534 }
535 } else {
536 s->dma_buf += count;
537 lsi_resume_script(s);
538 }
539 }
540
541
542 /* Add a command to the queue. */
543 static void lsi_queue_command(LSIState *s)
544 {
545 lsi_queue *p;
546
547 DPRINTF("Queueing tag=0x%x\n", s->current_tag);
548 if (s->queue_len == s->active_commands) {
549 s->queue_len++;
550 s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
551 }
552 p = &s->queue[s->active_commands++];
553 p->tag = s->current_tag;
554 p->pending = 0;
555 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
556 }
557
558 /* Queue a byte for a MSG IN phase. */
559 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
560 {
561 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
562 BADF("MSG IN data too long\n");
563 } else {
564 DPRINTF("MSG IN 0x%02x\n", data);
565 s->msg[s->msg_len++] = data;
566 }
567 }
568
569 /* Perform reselection to continue a command. */
570 static void lsi_reselect(LSIState *s, uint32_t tag)
571 {
572 lsi_queue *p;
573 int n;
574 int id;
575
576 p = NULL;
577 for (n = 0; n < s->active_commands; n++) {
578 p = &s->queue[n];
579 if (p->tag == tag)
580 break;
581 }
582 if (n == s->active_commands) {
583 BADF("Reselected non-existant command tag=0x%x\n", tag);
584 return;
585 }
586 id = (tag >> 8) & 0xf;
587 s->ssid = id | 0x80;
588 DPRINTF("Reselected target %d\n", id);
589 s->current_dev = s->bus.devs[id];
590 s->current_tag = tag;
591 s->scntl1 |= LSI_SCNTL1_CON;
592 lsi_set_phase(s, PHASE_MI);
593 s->msg_action = p->out ? 2 : 3;
594 s->current_dma_len = p->pending;
595 s->dma_buf = NULL;
596 lsi_add_msg_byte(s, 0x80);
597 if (s->current_tag & LSI_TAG_VALID) {
598 lsi_add_msg_byte(s, 0x20);
599 lsi_add_msg_byte(s, tag & 0xff);
600 }
601
602 s->active_commands--;
603 if (n != s->active_commands) {
604 s->queue[n] = s->queue[s->active_commands];
605 }
606 }
607
608 /* Record that data is available for a queued command. Returns zero if
609 the device was reselected, nonzero if the IO is deferred. */
610 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
611 {
612 lsi_queue *p;
613 int i;
614 for (i = 0; i < s->active_commands; i++) {
615 p = &s->queue[i];
616 if (p->tag == tag) {
617 if (p->pending) {
618 BADF("Multiple IO pending for tag %d\n", tag);
619 }
620 p->pending = arg;
621 if (s->waiting == 1) {
622 /* Reselect device. */
623 lsi_reselect(s, tag);
624 return 0;
625 } else {
626 DPRINTF("Queueing IO tag=0x%x\n", tag);
627 p->pending = arg;
628 return 1;
629 }
630 }
631 }
632 BADF("IO with unknown tag %d\n", tag);
633 return 1;
634 }
635
636 /* Callback to indicate that the SCSI layer has completed a transfer. */
637 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
638 uint32_t arg)
639 {
640 LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
641 int out;
642
643 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
644 if (reason == SCSI_REASON_DONE) {
645 DPRINTF("Command complete sense=%d\n", (int)arg);
646 s->sense = arg;
647 s->command_complete = 2;
648 if (s->waiting && s->dbc != 0) {
649 /* Raise phase mismatch for short transfers. */
650 lsi_bad_phase(s, out, PHASE_ST);
651 } else {
652 lsi_set_phase(s, PHASE_ST);
653 }
654 lsi_resume_script(s);
655 return;
656 }
657
658 if (s->waiting == 1 || tag != s->current_tag) {
659 if (lsi_queue_tag(s, tag, arg))
660 return;
661 }
662 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
663 s->current_dma_len = arg;
664 s->command_complete = 1;
665 if (!s->waiting)
666 return;
667 if (s->waiting == 1 || s->dbc == 0) {
668 lsi_resume_script(s);
669 } else {
670 lsi_do_dma(s, out);
671 }
672 }
673
674 static void lsi_do_command(LSIState *s)
675 {
676 uint8_t buf[16];
677 int n;
678
679 DPRINTF("Send command len=%d\n", s->dbc);
680 if (s->dbc > 16)
681 s->dbc = 16;
682 cpu_physical_memory_read(s->dnad, buf, s->dbc);
683 s->sfbr = buf[0];
684 s->command_complete = 0;
685 n = s->current_dev->info->send_command(s->current_dev, s->current_tag, buf,
686 s->current_lun);
687 if (n > 0) {
688 lsi_set_phase(s, PHASE_DI);
689 s->current_dev->info->read_data(s->current_dev, s->current_tag);
690 } else if (n < 0) {
691 lsi_set_phase(s, PHASE_DO);
692 s->current_dev->info->write_data(s->current_dev, s->current_tag);
693 }
694
695 if (!s->command_complete) {
696 if (n) {
697 /* Command did not complete immediately so disconnect. */
698 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
699 lsi_add_msg_byte(s, 4); /* DISCONNECT */
700 /* wait data */
701 lsi_set_phase(s, PHASE_MI);
702 s->msg_action = 1;
703 lsi_queue_command(s);
704 } else {
705 /* wait command complete */
706 lsi_set_phase(s, PHASE_DI);
707 }
708 }
709 }
710
711 static void lsi_do_status(LSIState *s)
712 {
713 uint8_t sense;
714 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
715 if (s->dbc != 1)
716 BADF("Bad Status move\n");
717 s->dbc = 1;
718 sense = s->sense;
719 s->sfbr = sense;
720 cpu_physical_memory_write(s->dnad, &sense, 1);
721 lsi_set_phase(s, PHASE_MI);
722 s->msg_action = 1;
723 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
724 }
725
726 static void lsi_disconnect(LSIState *s)
727 {
728 s->scntl1 &= ~LSI_SCNTL1_CON;
729 s->sstat1 &= ~PHASE_MASK;
730 }
731
732 static void lsi_do_msgin(LSIState *s)
733 {
734 int len;
735 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
736 s->sfbr = s->msg[0];
737 len = s->msg_len;
738 if (len > s->dbc)
739 len = s->dbc;
740 cpu_physical_memory_write(s->dnad, s->msg, len);
741 /* Linux drivers rely on the last byte being in the SIDL. */
742 s->sidl = s->msg[len - 1];
743 s->msg_len -= len;
744 if (s->msg_len) {
745 memmove(s->msg, s->msg + len, s->msg_len);
746 } else {
747 /* ??? Check if ATN (not yet implemented) is asserted and maybe
748 switch to PHASE_MO. */
749 switch (s->msg_action) {
750 case 0:
751 lsi_set_phase(s, PHASE_CMD);
752 break;
753 case 1:
754 lsi_disconnect(s);
755 break;
756 case 2:
757 lsi_set_phase(s, PHASE_DO);
758 break;
759 case 3:
760 lsi_set_phase(s, PHASE_DI);
761 break;
762 default:
763 abort();
764 }
765 }
766 }
767
768 /* Read the next byte during a MSGOUT phase. */
769 static uint8_t lsi_get_msgbyte(LSIState *s)
770 {
771 uint8_t data;
772 cpu_physical_memory_read(s->dnad, &data, 1);
773 s->dnad++;
774 s->dbc--;
775 return data;
776 }
777
778 static void lsi_do_msgout(LSIState *s)
779 {
780 uint8_t msg;
781 int len;
782
783 DPRINTF("MSG out len=%d\n", s->dbc);
784 while (s->dbc) {
785 msg = lsi_get_msgbyte(s);
786 s->sfbr = msg;
787
788 switch (msg) {
789 case 0x00:
790 DPRINTF("MSG: Disconnect\n");
791 lsi_disconnect(s);
792 break;
793 case 0x08:
794 DPRINTF("MSG: No Operation\n");
795 lsi_set_phase(s, PHASE_CMD);
796 break;
797 case 0x01:
798 len = lsi_get_msgbyte(s);
799 msg = lsi_get_msgbyte(s);
800 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
801 switch (msg) {
802 case 1:
803 DPRINTF("SDTR (ignored)\n");
804 s->dbc -= 2;
805 break;
806 case 3:
807 DPRINTF("WDTR (ignored)\n");
808 s->dbc -= 1;
809 break;
810 default:
811 goto bad;
812 }
813 break;
814 case 0x20: /* SIMPLE queue */
815 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
816 DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
817 break;
818 case 0x21: /* HEAD of queue */
819 BADF("HEAD queue not implemented\n");
820 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
821 break;
822 case 0x22: /* ORDERED queue */
823 BADF("ORDERED queue not implemented\n");
824 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
825 break;
826 default:
827 if ((msg & 0x80) == 0) {
828 goto bad;
829 }
830 s->current_lun = msg & 7;
831 DPRINTF("Select LUN %d\n", s->current_lun);
832 lsi_set_phase(s, PHASE_CMD);
833 break;
834 }
835 }
836 return;
837 bad:
838 BADF("Unimplemented message 0x%02x\n", msg);
839 lsi_set_phase(s, PHASE_MI);
840 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
841 s->msg_action = 0;
842 }
843
844 /* Sign extend a 24-bit value. */
845 static inline int32_t sxt24(int32_t n)
846 {
847 return (n << 8) >> 8;
848 }
849
850 #define LSI_BUF_SIZE 4096
851 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
852 {
853 int n;
854 uint8_t buf[LSI_BUF_SIZE];
855
856 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
857 while (count) {
858 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
859 cpu_physical_memory_read(src, buf, n);
860 cpu_physical_memory_write(dest, buf, n);
861 src += n;
862 dest += n;
863 count -= n;
864 }
865 }
866
867 static void lsi_wait_reselect(LSIState *s)
868 {
869 int i;
870 DPRINTF("Wait Reselect\n");
871 if (s->current_dma_len)
872 BADF("Reselect with pending DMA\n");
873 for (i = 0; i < s->active_commands; i++) {
874 if (s->queue[i].pending) {
875 lsi_reselect(s, s->queue[i].tag);
876 break;
877 }
878 }
879 if (s->current_dma_len == 0) {
880 s->waiting = 1;
881 }
882 }
883
884 static void lsi_execute_script(LSIState *s)
885 {
886 uint32_t insn;
887 uint32_t addr, addr_high;
888 int opcode;
889 int insn_processed = 0;
890
891 s->istat1 |= LSI_ISTAT1_SRUN;
892 again:
893 insn_processed++;
894 insn = read_dword(s, s->dsp);
895 if (!insn) {
896 /* If we receive an empty opcode increment the DSP by 4 bytes
897 instead of 8 and execute the next opcode at that location */
898 s->dsp += 4;
899 goto again;
900 }
901 addr = read_dword(s, s->dsp + 4);
902 addr_high = 0;
903 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
904 s->dsps = addr;
905 s->dcmd = insn >> 24;
906 s->dsp += 8;
907 switch (insn >> 30) {
908 case 0: /* Block move. */
909 if (s->sist1 & LSI_SIST1_STO) {
910 DPRINTF("Delayed select timeout\n");
911 lsi_stop_script(s);
912 break;
913 }
914 s->dbc = insn & 0xffffff;
915 s->rbc = s->dbc;
916 /* ??? Set ESA. */
917 s->ia = s->dsp - 8;
918 if (insn & (1 << 29)) {
919 /* Indirect addressing. */
920 addr = read_dword(s, addr);
921 } else if (insn & (1 << 28)) {
922 uint32_t buf[2];
923 int32_t offset;
924 /* Table indirect addressing. */
925
926 /* 32-bit Table indirect */
927 offset = sxt24(addr);
928 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
929 /* byte count is stored in bits 0:23 only */
930 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
931 s->rbc = s->dbc;
932 addr = cpu_to_le32(buf[1]);
933
934 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
935 * table, bits [31:24] */
936 if (lsi_dma_40bit(s))
937 addr_high = cpu_to_le32(buf[0]) >> 24;
938 else if (lsi_dma_ti64bit(s)) {
939 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
940 switch (selector) {
941 case 0 ... 0x0f:
942 /* offset index into scratch registers since
943 * TI64 mode can use registers C to R */
944 addr_high = s->scratch[2 + selector];
945 break;
946 case 0x10:
947 addr_high = s->mmrs;
948 break;
949 case 0x11:
950 addr_high = s->mmws;
951 break;
952 case 0x12:
953 addr_high = s->sfs;
954 break;
955 case 0x13:
956 addr_high = s->drs;
957 break;
958 case 0x14:
959 addr_high = s->sbms;
960 break;
961 case 0x15:
962 addr_high = s->dbms;
963 break;
964 default:
965 BADF("Illegal selector specified (0x%x > 0x15)"
966 " for 64-bit DMA block move", selector);
967 break;
968 }
969 }
970 } else if (lsi_dma_64bit(s)) {
971 /* fetch a 3rd dword if 64-bit direct move is enabled and
972 only if we're not doing table indirect or indirect addressing */
973 s->dbms = read_dword(s, s->dsp);
974 s->dsp += 4;
975 s->ia = s->dsp - 12;
976 }
977 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
978 DPRINTF("Wrong phase got %d expected %d\n",
979 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
980 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
981 break;
982 }
983 s->dnad = addr;
984 s->dnad64 = addr_high;
985 switch (s->sstat1 & 0x7) {
986 case PHASE_DO:
987 s->waiting = 2;
988 lsi_do_dma(s, 1);
989 if (s->waiting)
990 s->waiting = 3;
991 break;
992 case PHASE_DI:
993 s->waiting = 2;
994 lsi_do_dma(s, 0);
995 if (s->waiting)
996 s->waiting = 3;
997 break;
998 case PHASE_CMD:
999 lsi_do_command(s);
1000 break;
1001 case PHASE_ST:
1002 lsi_do_status(s);
1003 break;
1004 case PHASE_MO:
1005 lsi_do_msgout(s);
1006 break;
1007 case PHASE_MI:
1008 lsi_do_msgin(s);
1009 break;
1010 default:
1011 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1012 exit(1);
1013 }
1014 s->dfifo = s->dbc & 0xff;
1015 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1016 s->sbc = s->dbc;
1017 s->rbc -= s->dbc;
1018 s->ua = addr + s->dbc;
1019 break;
1020
1021 case 1: /* IO or Read/Write instruction. */
1022 opcode = (insn >> 27) & 7;
1023 if (opcode < 5) {
1024 uint32_t id;
1025
1026 if (insn & (1 << 25)) {
1027 id = read_dword(s, s->dsa + sxt24(insn));
1028 } else {
1029 id = addr;
1030 }
1031 id = (id >> 16) & 0xf;
1032 if (insn & (1 << 26)) {
1033 addr = s->dsp + sxt24(addr);
1034 }
1035 s->dnad = addr;
1036 switch (opcode) {
1037 case 0: /* Select */
1038 s->sdid = id;
1039 if (s->current_dma_len && (s->ssid & 0xf) == id) {
1040 DPRINTF("Already reselected by target %d\n", id);
1041 break;
1042 }
1043 s->sstat0 |= LSI_SSTAT0_WOA;
1044 s->scntl1 &= ~LSI_SCNTL1_IARB;
1045 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1046 DPRINTF("Selected absent target %d\n", id);
1047 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1048 lsi_disconnect(s);
1049 break;
1050 }
1051 DPRINTF("Selected target %d%s\n",
1052 id, insn & (1 << 3) ? " ATN" : "");
1053 /* ??? Linux drivers compain when this is set. Maybe
1054 it only applies in low-level mode (unimplemented).
1055 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1056 s->current_dev = s->bus.devs[id];
1057 s->current_tag = id << 8;
1058 s->scntl1 |= LSI_SCNTL1_CON;
1059 if (insn & (1 << 3)) {
1060 s->socl |= LSI_SOCL_ATN;
1061 }
1062 lsi_set_phase(s, PHASE_MO);
1063 break;
1064 case 1: /* Disconnect */
1065 DPRINTF("Wait Disconect\n");
1066 s->scntl1 &= ~LSI_SCNTL1_CON;
1067 break;
1068 case 2: /* Wait Reselect */
1069 lsi_wait_reselect(s);
1070 break;
1071 case 3: /* Set */
1072 DPRINTF("Set%s%s%s%s\n",
1073 insn & (1 << 3) ? " ATN" : "",
1074 insn & (1 << 6) ? " ACK" : "",
1075 insn & (1 << 9) ? " TM" : "",
1076 insn & (1 << 10) ? " CC" : "");
1077 if (insn & (1 << 3)) {
1078 s->socl |= LSI_SOCL_ATN;
1079 lsi_set_phase(s, PHASE_MO);
1080 }
1081 if (insn & (1 << 9)) {
1082 BADF("Target mode not implemented\n");
1083 exit(1);
1084 }
1085 if (insn & (1 << 10))
1086 s->carry = 1;
1087 break;
1088 case 4: /* Clear */
1089 DPRINTF("Clear%s%s%s%s\n",
1090 insn & (1 << 3) ? " ATN" : "",
1091 insn & (1 << 6) ? " ACK" : "",
1092 insn & (1 << 9) ? " TM" : "",
1093 insn & (1 << 10) ? " CC" : "");
1094 if (insn & (1 << 3)) {
1095 s->socl &= ~LSI_SOCL_ATN;
1096 }
1097 if (insn & (1 << 10))
1098 s->carry = 0;
1099 break;
1100 }
1101 } else {
1102 uint8_t op0;
1103 uint8_t op1;
1104 uint8_t data8;
1105 int reg;
1106 int operator;
1107 #ifdef DEBUG_LSI
1108 static const char *opcode_names[3] =
1109 {"Write", "Read", "Read-Modify-Write"};
1110 static const char *operator_names[8] =
1111 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1112 #endif
1113
1114 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1115 data8 = (insn >> 8) & 0xff;
1116 opcode = (insn >> 27) & 7;
1117 operator = (insn >> 24) & 7;
1118 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1119 opcode_names[opcode - 5], reg,
1120 operator_names[operator], data8, s->sfbr,
1121 (insn & (1 << 23)) ? " SFBR" : "");
1122 op0 = op1 = 0;
1123 switch (opcode) {
1124 case 5: /* From SFBR */
1125 op0 = s->sfbr;
1126 op1 = data8;
1127 break;
1128 case 6: /* To SFBR */
1129 if (operator)
1130 op0 = lsi_reg_readb(s, reg);
1131 op1 = data8;
1132 break;
1133 case 7: /* Read-modify-write */
1134 if (operator)
1135 op0 = lsi_reg_readb(s, reg);
1136 if (insn & (1 << 23)) {
1137 op1 = s->sfbr;
1138 } else {
1139 op1 = data8;
1140 }
1141 break;
1142 }
1143
1144 switch (operator) {
1145 case 0: /* move */
1146 op0 = op1;
1147 break;
1148 case 1: /* Shift left */
1149 op1 = op0 >> 7;
1150 op0 = (op0 << 1) | s->carry;
1151 s->carry = op1;
1152 break;
1153 case 2: /* OR */
1154 op0 |= op1;
1155 break;
1156 case 3: /* XOR */
1157 op0 ^= op1;
1158 break;
1159 case 4: /* AND */
1160 op0 &= op1;
1161 break;
1162 case 5: /* SHR */
1163 op1 = op0 & 1;
1164 op0 = (op0 >> 1) | (s->carry << 7);
1165 s->carry = op1;
1166 break;
1167 case 6: /* ADD */
1168 op0 += op1;
1169 s->carry = op0 < op1;
1170 break;
1171 case 7: /* ADC */
1172 op0 += op1 + s->carry;
1173 if (s->carry)
1174 s->carry = op0 <= op1;
1175 else
1176 s->carry = op0 < op1;
1177 break;
1178 }
1179
1180 switch (opcode) {
1181 case 5: /* From SFBR */
1182 case 7: /* Read-modify-write */
1183 lsi_reg_writeb(s, reg, op0);
1184 break;
1185 case 6: /* To SFBR */
1186 s->sfbr = op0;
1187 break;
1188 }
1189 }
1190 break;
1191
1192 case 2: /* Transfer Control. */
1193 {
1194 int cond;
1195 int jmp;
1196
1197 if ((insn & 0x002e0000) == 0) {
1198 DPRINTF("NOP\n");
1199 break;
1200 }
1201 if (s->sist1 & LSI_SIST1_STO) {
1202 DPRINTF("Delayed select timeout\n");
1203 lsi_stop_script(s);
1204 break;
1205 }
1206 cond = jmp = (insn & (1 << 19)) != 0;
1207 if (cond == jmp && (insn & (1 << 21))) {
1208 DPRINTF("Compare carry %d\n", s->carry == jmp);
1209 cond = s->carry != 0;
1210 }
1211 if (cond == jmp && (insn & (1 << 17))) {
1212 DPRINTF("Compare phase %d %c= %d\n",
1213 (s->sstat1 & PHASE_MASK),
1214 jmp ? '=' : '!',
1215 ((insn >> 24) & 7));
1216 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1217 }
1218 if (cond == jmp && (insn & (1 << 18))) {
1219 uint8_t mask;
1220
1221 mask = (~insn >> 8) & 0xff;
1222 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1223 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1224 cond = (s->sfbr & mask) == (insn & mask);
1225 }
1226 if (cond == jmp) {
1227 if (insn & (1 << 23)) {
1228 /* Relative address. */
1229 addr = s->dsp + sxt24(addr);
1230 }
1231 switch ((insn >> 27) & 7) {
1232 case 0: /* Jump */
1233 DPRINTF("Jump to 0x%08x\n", addr);
1234 s->dsp = addr;
1235 break;
1236 case 1: /* Call */
1237 DPRINTF("Call 0x%08x\n", addr);
1238 s->temp = s->dsp;
1239 s->dsp = addr;
1240 break;
1241 case 2: /* Return */
1242 DPRINTF("Return to 0x%08x\n", s->temp);
1243 s->dsp = s->temp;
1244 break;
1245 case 3: /* Interrupt */
1246 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1247 if ((insn & (1 << 20)) != 0) {
1248 s->istat0 |= LSI_ISTAT0_INTF;
1249 lsi_update_irq(s);
1250 } else {
1251 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1252 }
1253 break;
1254 default:
1255 DPRINTF("Illegal transfer control\n");
1256 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1257 break;
1258 }
1259 } else {
1260 DPRINTF("Control condition failed\n");
1261 }
1262 }
1263 break;
1264
1265 case 3:
1266 if ((insn & (1 << 29)) == 0) {
1267 /* Memory move. */
1268 uint32_t dest;
1269 /* ??? The docs imply the destination address is loaded into
1270 the TEMP register. However the Linux drivers rely on
1271 the value being presrved. */
1272 dest = read_dword(s, s->dsp);
1273 s->dsp += 4;
1274 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1275 } else {
1276 uint8_t data[7];
1277 int reg;
1278 int n;
1279 int i;
1280
1281 if (insn & (1 << 28)) {
1282 addr = s->dsa + sxt24(addr);
1283 }
1284 n = (insn & 7);
1285 reg = (insn >> 16) & 0xff;
1286 if (insn & (1 << 24)) {
1287 cpu_physical_memory_read(addr, data, n);
1288 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1289 addr, *(int *)data);
1290 for (i = 0; i < n; i++) {
1291 lsi_reg_writeb(s, reg + i, data[i]);
1292 }
1293 } else {
1294 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1295 for (i = 0; i < n; i++) {
1296 data[i] = lsi_reg_readb(s, reg + i);
1297 }
1298 cpu_physical_memory_write(addr, data, n);
1299 }
1300 }
1301 }
1302 if (insn_processed > 10000 && !s->waiting) {
1303 /* Some windows drivers make the device spin waiting for a memory
1304 location to change. If we have been executed a lot of code then
1305 assume this is the case and force an unexpected device disconnect.
1306 This is apparently sufficient to beat the drivers into submission.
1307 */
1308 if (!(s->sien0 & LSI_SIST0_UDC))
1309 fprintf(stderr, "inf. loop with UDC masked\n");
1310 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1311 lsi_disconnect(s);
1312 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1313 if (s->dcntl & LSI_DCNTL_SSM) {
1314 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1315 } else {
1316 goto again;
1317 }
1318 }
1319 DPRINTF("SCRIPTS execution stopped\n");
1320 }
1321
1322 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1323 {
1324 uint8_t tmp;
1325 #define CASE_GET_REG24(name, addr) \
1326 case addr: return s->name & 0xff; \
1327 case addr + 1: return (s->name >> 8) & 0xff; \
1328 case addr + 2: return (s->name >> 16) & 0xff;
1329
1330 #define CASE_GET_REG32(name, addr) \
1331 case addr: return s->name & 0xff; \
1332 case addr + 1: return (s->name >> 8) & 0xff; \
1333 case addr + 2: return (s->name >> 16) & 0xff; \
1334 case addr + 3: return (s->name >> 24) & 0xff;
1335
1336 #ifdef DEBUG_LSI_REG
1337 DPRINTF("Read reg %x\n", offset);
1338 #endif
1339 switch (offset) {
1340 case 0x00: /* SCNTL0 */
1341 return s->scntl0;
1342 case 0x01: /* SCNTL1 */
1343 return s->scntl1;
1344 case 0x02: /* SCNTL2 */
1345 return s->scntl2;
1346 case 0x03: /* SCNTL3 */
1347 return s->scntl3;
1348 case 0x04: /* SCID */
1349 return s->scid;
1350 case 0x05: /* SXFER */
1351 return s->sxfer;
1352 case 0x06: /* SDID */
1353 return s->sdid;
1354 case 0x07: /* GPREG0 */
1355 return 0x7f;
1356 case 0x08: /* Revision ID */
1357 return 0x00;
1358 case 0xa: /* SSID */
1359 return s->ssid;
1360 case 0xb: /* SBCL */
1361 /* ??? This is not correct. However it's (hopefully) only
1362 used for diagnostics, so should be ok. */
1363 return 0;
1364 case 0xc: /* DSTAT */
1365 tmp = s->dstat | 0x80;
1366 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1367 s->dstat = 0;
1368 lsi_update_irq(s);
1369 return tmp;
1370 case 0x0d: /* SSTAT0 */
1371 return s->sstat0;
1372 case 0x0e: /* SSTAT1 */
1373 return s->sstat1;
1374 case 0x0f: /* SSTAT2 */
1375 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1376 CASE_GET_REG32(dsa, 0x10)
1377 case 0x14: /* ISTAT0 */
1378 return s->istat0;
1379 case 0x15: /* ISTAT1 */
1380 return s->istat1;
1381 case 0x16: /* MBOX0 */
1382 return s->mbox0;
1383 case 0x17: /* MBOX1 */
1384 return s->mbox1;
1385 case 0x18: /* CTEST0 */
1386 return 0xff;
1387 case 0x19: /* CTEST1 */
1388 return 0;
1389 case 0x1a: /* CTEST2 */
1390 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1391 if (s->istat0 & LSI_ISTAT0_SIGP) {
1392 s->istat0 &= ~LSI_ISTAT0_SIGP;
1393 tmp |= LSI_CTEST2_SIGP;
1394 }
1395 return tmp;
1396 case 0x1b: /* CTEST3 */
1397 return s->ctest3;
1398 CASE_GET_REG32(temp, 0x1c)
1399 case 0x20: /* DFIFO */
1400 return 0;
1401 case 0x21: /* CTEST4 */
1402 return s->ctest4;
1403 case 0x22: /* CTEST5 */
1404 return s->ctest5;
1405 case 0x23: /* CTEST6 */
1406 return 0;
1407 CASE_GET_REG24(dbc, 0x24)
1408 case 0x27: /* DCMD */
1409 return s->dcmd;
1410 CASE_GET_REG32(dnad, 0x28)
1411 CASE_GET_REG32(dsp, 0x2c)
1412 CASE_GET_REG32(dsps, 0x30)
1413 CASE_GET_REG32(scratch[0], 0x34)
1414 case 0x38: /* DMODE */
1415 return s->dmode;
1416 case 0x39: /* DIEN */
1417 return s->dien;
1418 case 0x3a: /* SBR */
1419 return s->sbr;
1420 case 0x3b: /* DCNTL */
1421 return s->dcntl;
1422 case 0x40: /* SIEN0 */
1423 return s->sien0;
1424 case 0x41: /* SIEN1 */
1425 return s->sien1;
1426 case 0x42: /* SIST0 */
1427 tmp = s->sist0;
1428 s->sist0 = 0;
1429 lsi_update_irq(s);
1430 return tmp;
1431 case 0x43: /* SIST1 */
1432 tmp = s->sist1;
1433 s->sist1 = 0;
1434 lsi_update_irq(s);
1435 return tmp;
1436 case 0x46: /* MACNTL */
1437 return 0x0f;
1438 case 0x47: /* GPCNTL0 */
1439 return 0x0f;
1440 case 0x48: /* STIME0 */
1441 return s->stime0;
1442 case 0x4a: /* RESPID0 */
1443 return s->respid0;
1444 case 0x4b: /* RESPID1 */
1445 return s->respid1;
1446 case 0x4d: /* STEST1 */
1447 return s->stest1;
1448 case 0x4e: /* STEST2 */
1449 return s->stest2;
1450 case 0x4f: /* STEST3 */
1451 return s->stest3;
1452 case 0x50: /* SIDL */
1453 /* This is needed by the linux drivers. We currently only update it
1454 during the MSG IN phase. */
1455 return s->sidl;
1456 case 0x52: /* STEST4 */
1457 return 0xe0;
1458 case 0x56: /* CCNTL0 */
1459 return s->ccntl0;
1460 case 0x57: /* CCNTL1 */
1461 return s->ccntl1;
1462 case 0x58: /* SBDL */
1463 /* Some drivers peek at the data bus during the MSG IN phase. */
1464 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1465 return s->msg[0];
1466 return 0;
1467 case 0x59: /* SBDL high */
1468 return 0;
1469 CASE_GET_REG32(mmrs, 0xa0)
1470 CASE_GET_REG32(mmws, 0xa4)
1471 CASE_GET_REG32(sfs, 0xa8)
1472 CASE_GET_REG32(drs, 0xac)
1473 CASE_GET_REG32(sbms, 0xb0)
1474 CASE_GET_REG32(dbms, 0xb4)
1475 CASE_GET_REG32(dnad64, 0xb8)
1476 CASE_GET_REG32(pmjad1, 0xc0)
1477 CASE_GET_REG32(pmjad2, 0xc4)
1478 CASE_GET_REG32(rbc, 0xc8)
1479 CASE_GET_REG32(ua, 0xcc)
1480 CASE_GET_REG32(ia, 0xd4)
1481 CASE_GET_REG32(sbc, 0xd8)
1482 CASE_GET_REG32(csbc, 0xdc)
1483 }
1484 if (offset >= 0x5c && offset < 0xa0) {
1485 int n;
1486 int shift;
1487 n = (offset - 0x58) >> 2;
1488 shift = (offset & 3) * 8;
1489 return (s->scratch[n] >> shift) & 0xff;
1490 }
1491 BADF("readb 0x%x\n", offset);
1492 exit(1);
1493 #undef CASE_GET_REG24
1494 #undef CASE_GET_REG32
1495 }
1496
1497 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1498 {
1499 #define CASE_SET_REG24(name, addr) \
1500 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1501 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1502 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1503
1504 #define CASE_SET_REG32(name, addr) \
1505 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1506 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1507 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1508 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1509
1510 #ifdef DEBUG_LSI_REG
1511 DPRINTF("Write reg %x = %02x\n", offset, val);
1512 #endif
1513 switch (offset) {
1514 case 0x00: /* SCNTL0 */
1515 s->scntl0 = val;
1516 if (val & LSI_SCNTL0_START) {
1517 BADF("Start sequence not implemented\n");
1518 }
1519 break;
1520 case 0x01: /* SCNTL1 */
1521 s->scntl1 = val & ~LSI_SCNTL1_SST;
1522 if (val & LSI_SCNTL1_IARB) {
1523 BADF("Immediate Arbritration not implemented\n");
1524 }
1525 if (val & LSI_SCNTL1_RST) {
1526 s->sstat0 |= LSI_SSTAT0_RST;
1527 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1528 } else {
1529 s->sstat0 &= ~LSI_SSTAT0_RST;
1530 }
1531 break;
1532 case 0x02: /* SCNTL2 */
1533 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1534 s->scntl2 = val;
1535 break;
1536 case 0x03: /* SCNTL3 */
1537 s->scntl3 = val;
1538 break;
1539 case 0x04: /* SCID */
1540 s->scid = val;
1541 break;
1542 case 0x05: /* SXFER */
1543 s->sxfer = val;
1544 break;
1545 case 0x06: /* SDID */
1546 if ((val & 0xf) != (s->ssid & 0xf))
1547 BADF("Destination ID does not match SSID\n");
1548 s->sdid = val & 0xf;
1549 break;
1550 case 0x07: /* GPREG0 */
1551 break;
1552 case 0x08: /* SFBR */
1553 /* The CPU is not allowed to write to this register. However the
1554 SCRIPTS register move instructions are. */
1555 s->sfbr = val;
1556 break;
1557 case 0x0a: case 0x0b:
1558 /* Openserver writes to these readonly registers on startup */
1559 return;
1560 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1561 /* Linux writes to these readonly registers on startup. */
1562 return;
1563 CASE_SET_REG32(dsa, 0x10)
1564 case 0x14: /* ISTAT0 */
1565 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1566 if (val & LSI_ISTAT0_ABRT) {
1567 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1568 }
1569 if (val & LSI_ISTAT0_INTF) {
1570 s->istat0 &= ~LSI_ISTAT0_INTF;
1571 lsi_update_irq(s);
1572 }
1573 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1574 DPRINTF("Woken by SIGP\n");
1575 s->waiting = 0;
1576 s->dsp = s->dnad;
1577 lsi_execute_script(s);
1578 }
1579 if (val & LSI_ISTAT0_SRST) {
1580 lsi_soft_reset(s);
1581 }
1582 break;
1583 case 0x16: /* MBOX0 */
1584 s->mbox0 = val;
1585 break;
1586 case 0x17: /* MBOX1 */
1587 s->mbox1 = val;
1588 break;
1589 case 0x1a: /* CTEST2 */
1590 s->ctest2 = val & LSI_CTEST2_PCICIE;
1591 break;
1592 case 0x1b: /* CTEST3 */
1593 s->ctest3 = val & 0x0f;
1594 break;
1595 CASE_SET_REG32(temp, 0x1c)
1596 case 0x21: /* CTEST4 */
1597 if (val & 7) {
1598 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1599 }
1600 s->ctest4 = val;
1601 break;
1602 case 0x22: /* CTEST5 */
1603 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1604 BADF("CTEST5 DMA increment not implemented\n");
1605 }
1606 s->ctest5 = val;
1607 break;
1608 CASE_SET_REG24(dbc, 0x24)
1609 CASE_SET_REG32(dnad, 0x28)
1610 case 0x2c: /* DSP[0:7] */
1611 s->dsp &= 0xffffff00;
1612 s->dsp |= val;
1613 break;
1614 case 0x2d: /* DSP[8:15] */
1615 s->dsp &= 0xffff00ff;
1616 s->dsp |= val << 8;
1617 break;
1618 case 0x2e: /* DSP[16:23] */
1619 s->dsp &= 0xff00ffff;
1620 s->dsp |= val << 16;
1621 break;
1622 case 0x2f: /* DSP[24:31] */
1623 s->dsp &= 0x00ffffff;
1624 s->dsp |= val << 24;
1625 if ((s->dmode & LSI_DMODE_MAN) == 0
1626 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1627 lsi_execute_script(s);
1628 break;
1629 CASE_SET_REG32(dsps, 0x30)
1630 CASE_SET_REG32(scratch[0], 0x34)
1631 case 0x38: /* DMODE */
1632 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1633 BADF("IO mappings not implemented\n");
1634 }
1635 s->dmode = val;
1636 break;
1637 case 0x39: /* DIEN */
1638 s->dien = val;
1639 lsi_update_irq(s);
1640 break;
1641 case 0x3a: /* SBR */
1642 s->sbr = val;
1643 break;
1644 case 0x3b: /* DCNTL */
1645 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1646 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1647 lsi_execute_script(s);
1648 break;
1649 case 0x40: /* SIEN0 */
1650 s->sien0 = val;
1651 lsi_update_irq(s);
1652 break;
1653 case 0x41: /* SIEN1 */
1654 s->sien1 = val;
1655 lsi_update_irq(s);
1656 break;
1657 case 0x47: /* GPCNTL0 */
1658 break;
1659 case 0x48: /* STIME0 */
1660 s->stime0 = val;
1661 break;
1662 case 0x49: /* STIME1 */
1663 if (val & 0xf) {
1664 DPRINTF("General purpose timer not implemented\n");
1665 /* ??? Raising the interrupt immediately seems to be sufficient
1666 to keep the FreeBSD driver happy. */
1667 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1668 }
1669 break;
1670 case 0x4a: /* RESPID0 */
1671 s->respid0 = val;
1672 break;
1673 case 0x4b: /* RESPID1 */
1674 s->respid1 = val;
1675 break;
1676 case 0x4d: /* STEST1 */
1677 s->stest1 = val;
1678 break;
1679 case 0x4e: /* STEST2 */
1680 if (val & 1) {
1681 BADF("Low level mode not implemented\n");
1682 }
1683 s->stest2 = val;
1684 break;
1685 case 0x4f: /* STEST3 */
1686 if (val & 0x41) {
1687 BADF("SCSI FIFO test mode not implemented\n");
1688 }
1689 s->stest3 = val;
1690 break;
1691 case 0x56: /* CCNTL0 */
1692 s->ccntl0 = val;
1693 break;
1694 case 0x57: /* CCNTL1 */
1695 s->ccntl1 = val;
1696 break;
1697 CASE_SET_REG32(mmrs, 0xa0)
1698 CASE_SET_REG32(mmws, 0xa4)
1699 CASE_SET_REG32(sfs, 0xa8)
1700 CASE_SET_REG32(drs, 0xac)
1701 CASE_SET_REG32(sbms, 0xb0)
1702 CASE_SET_REG32(dbms, 0xb4)
1703 CASE_SET_REG32(dnad64, 0xb8)
1704 CASE_SET_REG32(pmjad1, 0xc0)
1705 CASE_SET_REG32(pmjad2, 0xc4)
1706 CASE_SET_REG32(rbc, 0xc8)
1707 CASE_SET_REG32(ua, 0xcc)
1708 CASE_SET_REG32(ia, 0xd4)
1709 CASE_SET_REG32(sbc, 0xd8)
1710 CASE_SET_REG32(csbc, 0xdc)
1711 default:
1712 if (offset >= 0x5c && offset < 0xa0) {
1713 int n;
1714 int shift;
1715 n = (offset - 0x58) >> 2;
1716 shift = (offset & 3) * 8;
1717 s->scratch[n] &= ~(0xff << shift);
1718 s->scratch[n] |= (val & 0xff) << shift;
1719 } else {
1720 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1721 }
1722 }
1723 #undef CASE_SET_REG24
1724 #undef CASE_SET_REG32
1725 }
1726
1727 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1728 {
1729 LSIState *s = opaque;
1730
1731 lsi_reg_writeb(s, addr & 0xff, val);
1732 }
1733
1734 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1735 {
1736 LSIState *s = opaque;
1737
1738 addr &= 0xff;
1739 lsi_reg_writeb(s, addr, val & 0xff);
1740 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1741 }
1742
1743 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1744 {
1745 LSIState *s = opaque;
1746
1747 addr &= 0xff;
1748 lsi_reg_writeb(s, addr, val & 0xff);
1749 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1750 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1751 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1752 }
1753
1754 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1755 {
1756 LSIState *s = opaque;
1757
1758 return lsi_reg_readb(s, addr & 0xff);
1759 }
1760
1761 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1762 {
1763 LSIState *s = opaque;
1764 uint32_t val;
1765
1766 addr &= 0xff;
1767 val = lsi_reg_readb(s, addr);
1768 val |= lsi_reg_readb(s, addr + 1) << 8;
1769 return val;
1770 }
1771
1772 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1773 {
1774 LSIState *s = opaque;
1775 uint32_t val;
1776 addr &= 0xff;
1777 val = lsi_reg_readb(s, addr);
1778 val |= lsi_reg_readb(s, addr + 1) << 8;
1779 val |= lsi_reg_readb(s, addr + 2) << 16;
1780 val |= lsi_reg_readb(s, addr + 3) << 24;
1781 return val;
1782 }
1783
1784 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1785 lsi_mmio_readb,
1786 lsi_mmio_readw,
1787 lsi_mmio_readl,
1788 };
1789
1790 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1791 lsi_mmio_writeb,
1792 lsi_mmio_writew,
1793 lsi_mmio_writel,
1794 };
1795
1796 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1797 {
1798 LSIState *s = opaque;
1799 uint32_t newval;
1800 int shift;
1801
1802 addr &= 0x1fff;
1803 newval = s->script_ram[addr >> 2];
1804 shift = (addr & 3) * 8;
1805 newval &= ~(0xff << shift);
1806 newval |= val << shift;
1807 s->script_ram[addr >> 2] = newval;
1808 }
1809
1810 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1811 {
1812 LSIState *s = opaque;
1813 uint32_t newval;
1814
1815 addr &= 0x1fff;
1816 newval = s->script_ram[addr >> 2];
1817 if (addr & 2) {
1818 newval = (newval & 0xffff) | (val << 16);
1819 } else {
1820 newval = (newval & 0xffff0000) | val;
1821 }
1822 s->script_ram[addr >> 2] = newval;
1823 }
1824
1825
1826 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1827 {
1828 LSIState *s = opaque;
1829
1830 addr &= 0x1fff;
1831 s->script_ram[addr >> 2] = val;
1832 }
1833
1834 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1835 {
1836 LSIState *s = opaque;
1837 uint32_t val;
1838
1839 addr &= 0x1fff;
1840 val = s->script_ram[addr >> 2];
1841 val >>= (addr & 3) * 8;
1842 return val & 0xff;
1843 }
1844
1845 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1846 {
1847 LSIState *s = opaque;
1848 uint32_t val;
1849
1850 addr &= 0x1fff;
1851 val = s->script_ram[addr >> 2];
1852 if (addr & 2)
1853 val >>= 16;
1854 return le16_to_cpu(val);
1855 }
1856
1857 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1858 {
1859 LSIState *s = opaque;
1860
1861 addr &= 0x1fff;
1862 return le32_to_cpu(s->script_ram[addr >> 2]);
1863 }
1864
1865 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1866 lsi_ram_readb,
1867 lsi_ram_readw,
1868 lsi_ram_readl,
1869 };
1870
1871 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1872 lsi_ram_writeb,
1873 lsi_ram_writew,
1874 lsi_ram_writel,
1875 };
1876
1877 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1878 {
1879 LSIState *s = opaque;
1880 return lsi_reg_readb(s, addr & 0xff);
1881 }
1882
1883 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1884 {
1885 LSIState *s = opaque;
1886 uint32_t val;
1887 addr &= 0xff;
1888 val = lsi_reg_readb(s, addr);
1889 val |= lsi_reg_readb(s, addr + 1) << 8;
1890 return val;
1891 }
1892
1893 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1894 {
1895 LSIState *s = opaque;
1896 uint32_t val;
1897 addr &= 0xff;
1898 val = lsi_reg_readb(s, addr);
1899 val |= lsi_reg_readb(s, addr + 1) << 8;
1900 val |= lsi_reg_readb(s, addr + 2) << 16;
1901 val |= lsi_reg_readb(s, addr + 3) << 24;
1902 return val;
1903 }
1904
1905 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1906 {
1907 LSIState *s = opaque;
1908 lsi_reg_writeb(s, addr & 0xff, val);
1909 }
1910
1911 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1912 {
1913 LSIState *s = opaque;
1914 addr &= 0xff;
1915 lsi_reg_writeb(s, addr, val & 0xff);
1916 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1917 }
1918
1919 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1920 {
1921 LSIState *s = opaque;
1922 addr &= 0xff;
1923 lsi_reg_writeb(s, addr, val & 0xff);
1924 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1925 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1926 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1927 }
1928
1929 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1930 pcibus_t addr, pcibus_t size, int type)
1931 {
1932 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1933
1934 DPRINTF("Mapping IO at %08x\n", addr);
1935
1936 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1937 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1938 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1939 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1940 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1941 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1942 }
1943
1944 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1945 pcibus_t addr, pcibus_t size, int type)
1946 {
1947 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1948
1949 DPRINTF("Mapping ram at %08x\n", addr);
1950 s->script_ram_base = addr;
1951 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1952 }
1953
1954 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1955 pcibus_t addr, pcibus_t size, int type)
1956 {
1957 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1958
1959 DPRINTF("Mapping registers at %08x\n", addr);
1960 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1961 }
1962
1963 static void lsi_pre_save(void *opaque)
1964 {
1965 LSIState *s = opaque;
1966
1967 assert(s->dma_buf == NULL);
1968 assert(s->current_dma_len == 0);
1969 assert(s->active_commands == 0);
1970 }
1971
1972 static const VMStateDescription vmstate_lsi_scsi = {
1973 .name = "lsiscsi",
1974 .version_id = 0,
1975 .minimum_version_id = 0,
1976 .minimum_version_id_old = 0,
1977 .pre_save = lsi_pre_save,
1978 .fields = (VMStateField []) {
1979 VMSTATE_PCI_DEVICE(dev, LSIState),
1980
1981 VMSTATE_INT32(carry, LSIState),
1982 VMSTATE_INT32(sense, LSIState),
1983 VMSTATE_INT32(msg_action, LSIState),
1984 VMSTATE_INT32(msg_len, LSIState),
1985 VMSTATE_BUFFER(msg, LSIState),
1986 VMSTATE_INT32(waiting, LSIState),
1987
1988 VMSTATE_UINT32(dsa, LSIState),
1989 VMSTATE_UINT32(temp, LSIState),
1990 VMSTATE_UINT32(dnad, LSIState),
1991 VMSTATE_UINT32(dbc, LSIState),
1992 VMSTATE_UINT8(istat0, LSIState),
1993 VMSTATE_UINT8(istat1, LSIState),
1994 VMSTATE_UINT8(dcmd, LSIState),
1995 VMSTATE_UINT8(dstat, LSIState),
1996 VMSTATE_UINT8(dien, LSIState),
1997 VMSTATE_UINT8(sist0, LSIState),
1998 VMSTATE_UINT8(sist1, LSIState),
1999 VMSTATE_UINT8(sien0, LSIState),
2000 VMSTATE_UINT8(sien1, LSIState),
2001 VMSTATE_UINT8(mbox0, LSIState),
2002 VMSTATE_UINT8(mbox1, LSIState),
2003 VMSTATE_UINT8(dfifo, LSIState),
2004 VMSTATE_UINT8(ctest2, LSIState),
2005 VMSTATE_UINT8(ctest3, LSIState),
2006 VMSTATE_UINT8(ctest4, LSIState),
2007 VMSTATE_UINT8(ctest5, LSIState),
2008 VMSTATE_UINT8(ccntl0, LSIState),
2009 VMSTATE_UINT8(ccntl1, LSIState),
2010 VMSTATE_UINT32(dsp, LSIState),
2011 VMSTATE_UINT32(dsps, LSIState),
2012 VMSTATE_UINT8(dmode, LSIState),
2013 VMSTATE_UINT8(dcntl, LSIState),
2014 VMSTATE_UINT8(scntl0, LSIState),
2015 VMSTATE_UINT8(scntl1, LSIState),
2016 VMSTATE_UINT8(scntl2, LSIState),
2017 VMSTATE_UINT8(scntl3, LSIState),
2018 VMSTATE_UINT8(sstat0, LSIState),
2019 VMSTATE_UINT8(sstat1, LSIState),
2020 VMSTATE_UINT8(scid, LSIState),
2021 VMSTATE_UINT8(sxfer, LSIState),
2022 VMSTATE_UINT8(socl, LSIState),
2023 VMSTATE_UINT8(sdid, LSIState),
2024 VMSTATE_UINT8(ssid, LSIState),
2025 VMSTATE_UINT8(sfbr, LSIState),
2026 VMSTATE_UINT8(stest1, LSIState),
2027 VMSTATE_UINT8(stest2, LSIState),
2028 VMSTATE_UINT8(stest3, LSIState),
2029 VMSTATE_UINT8(sidl, LSIState),
2030 VMSTATE_UINT8(stime0, LSIState),
2031 VMSTATE_UINT8(respid0, LSIState),
2032 VMSTATE_UINT8(respid1, LSIState),
2033 VMSTATE_UINT32(mmrs, LSIState),
2034 VMSTATE_UINT32(mmws, LSIState),
2035 VMSTATE_UINT32(sfs, LSIState),
2036 VMSTATE_UINT32(drs, LSIState),
2037 VMSTATE_UINT32(sbms, LSIState),
2038 VMSTATE_UINT32(dbms, LSIState),
2039 VMSTATE_UINT32(dnad64, LSIState),
2040 VMSTATE_UINT32(pmjad1, LSIState),
2041 VMSTATE_UINT32(pmjad2, LSIState),
2042 VMSTATE_UINT32(rbc, LSIState),
2043 VMSTATE_UINT32(ua, LSIState),
2044 VMSTATE_UINT32(ia, LSIState),
2045 VMSTATE_UINT32(sbc, LSIState),
2046 VMSTATE_UINT32(csbc, LSIState),
2047 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2048 VMSTATE_UINT8(sbr, LSIState),
2049
2050 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2051 VMSTATE_END_OF_LIST()
2052 }
2053 };
2054
2055 static int lsi_scsi_uninit(PCIDevice *d)
2056 {
2057 LSIState *s = DO_UPCAST(LSIState, dev, d);
2058
2059 cpu_unregister_io_memory(s->mmio_io_addr);
2060 cpu_unregister_io_memory(s->ram_io_addr);
2061
2062 qemu_free(s->queue);
2063
2064 return 0;
2065 }
2066
2067 static int lsi_scsi_init(PCIDevice *dev)
2068 {
2069 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2070 uint8_t *pci_conf;
2071
2072 pci_conf = s->dev.config;
2073
2074 /* PCI Vendor ID (word) */
2075 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2076 /* PCI device ID (word) */
2077 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2078 /* PCI base class code */
2079 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2080 /* PCI subsystem ID */
2081 pci_conf[0x2e] = 0x00;
2082 pci_conf[0x2f] = 0x10;
2083 /* PCI latency timer = 255 */
2084 pci_conf[0x0d] = 0xff;
2085 /* Interrupt pin 1 */
2086 pci_conf[0x3d] = 0x01;
2087
2088 s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2089 lsi_mmio_writefn, s);
2090 s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2091 lsi_ram_writefn, s);
2092
2093 pci_register_bar((struct PCIDevice *)s, 0, 256,
2094 PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2095 pci_register_bar((struct PCIDevice *)s, 1, 0x400,
2096 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
2097 pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
2098 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2099 s->queue = qemu_malloc(sizeof(lsi_queue));
2100 s->queue_len = 1;
2101 s->active_commands = 0;
2102
2103 lsi_soft_reset(s);
2104
2105 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2106 if (!dev->qdev.hotplugged) {
2107 scsi_bus_legacy_handle_cmdline(&s->bus);
2108 }
2109 vmstate_register(-1, &vmstate_lsi_scsi, s);
2110 return 0;
2111 }
2112
2113 static PCIDeviceInfo lsi_info = {
2114 .qdev.name = "lsi53c895a",
2115 .qdev.alias = "lsi",
2116 .qdev.size = sizeof(LSIState),
2117 .init = lsi_scsi_init,
2118 .exit = lsi_scsi_uninit,
2119 };
2120
2121 static void lsi53c895a_register_devices(void)
2122 {
2123 pci_qdev_register(&lsi_info);
2124 }
2125
2126 device_init(lsi53c895a_register_devices);
QEmu