?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
PCI: Convert pci_info() to QObject
[qemu.git] / hw / lsi53c895a.c
blob0daea400a8b592725ff87ba235028b133113f231
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licenced under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h>
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18 #include "block_int.h"
19
20 //#define DEBUG_LSI
21 //#define DEBUG_LSI_REG
22
23 #ifdef DEBUG_LSI
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
28 #else
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
32 #endif
33
34 #define LSI_MAX_DEVS 7
35
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
41
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
50
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
59
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
68
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
72
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
81
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
90
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
95
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
104
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
112
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
121
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
128
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
137
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
144
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
150
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
156
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
159
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
161
162 #define PHASE_DO 0
163 #define PHASE_DI 1
164 #define PHASE_CMD 2
165 #define PHASE_ST 3
166 #define PHASE_MO 6
167 #define PHASE_MI 7
168 #define PHASE_MASK 7
169
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
172
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
175
176 typedef struct lsi_request {
177 uint32_t tag;
178 SCSIDevice *dev;
179 uint32_t dma_len;
180 uint8_t *dma_buf;
181 uint32_t pending;
182 int out;
183 QTAILQ_ENTRY(lsi_request) next;
184 } lsi_request;
185
186 typedef struct {
187 PCIDevice dev;
188 int mmio_io_addr;
189 int ram_io_addr;
190 uint32_t script_ram_base;
191
192 int carry; /* ??? Should this be an a visible register somewhere? */
193 int sense;
194 /* Action to take at the end of a MSG IN phase.
195 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
196 int msg_action;
197 int msg_len;
198 uint8_t msg[LSI_MAX_MSGIN_LEN];
199 /* 0 if SCRIPTS are running or stopped.
200 * 1 if a Wait Reselect instruction has been issued.
201 * 2 if processing DMA from lsi_execute_script.
202 * 3 if a DMA operation is in progress. */
203 int waiting;
204 SCSIBus bus;
205 SCSIDevice *select_dev;
206 int current_lun;
207 /* The tag is a combination of the device ID and the SCSI tag. */
208 uint32_t select_tag;
209 int command_complete;
210 QTAILQ_HEAD(, lsi_request) queue;
211 lsi_request *current;
212
213 uint32_t dsa;
214 uint32_t temp;
215 uint32_t dnad;
216 uint32_t dbc;
217 uint8_t istat0;
218 uint8_t istat1;
219 uint8_t dcmd;
220 uint8_t dstat;
221 uint8_t dien;
222 uint8_t sist0;
223 uint8_t sist1;
224 uint8_t sien0;
225 uint8_t sien1;
226 uint8_t mbox0;
227 uint8_t mbox1;
228 uint8_t dfifo;
229 uint8_t ctest2;
230 uint8_t ctest3;
231 uint8_t ctest4;
232 uint8_t ctest5;
233 uint8_t ccntl0;
234 uint8_t ccntl1;
235 uint32_t dsp;
236 uint32_t dsps;
237 uint8_t dmode;
238 uint8_t dcntl;
239 uint8_t scntl0;
240 uint8_t scntl1;
241 uint8_t scntl2;
242 uint8_t scntl3;
243 uint8_t sstat0;
244 uint8_t sstat1;
245 uint8_t scid;
246 uint8_t sxfer;
247 uint8_t socl;
248 uint8_t sdid;
249 uint8_t ssid;
250 uint8_t sfbr;
251 uint8_t stest1;
252 uint8_t stest2;
253 uint8_t stest3;
254 uint8_t sidl;
255 uint8_t stime0;
256 uint8_t respid0;
257 uint8_t respid1;
258 uint32_t mmrs;
259 uint32_t mmws;
260 uint32_t sfs;
261 uint32_t drs;
262 uint32_t sbms;
263 uint32_t dbms;
264 uint32_t dnad64;
265 uint32_t pmjad1;
266 uint32_t pmjad2;
267 uint32_t rbc;
268 uint32_t ua;
269 uint32_t ia;
270 uint32_t sbc;
271 uint32_t csbc;
272 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
273 uint8_t sbr;
274
275 /* Script ram is stored as 32-bit words in host byteorder. */
276 uint32_t script_ram[2048];
277 } LSIState;
278
279 static inline int lsi_irq_on_rsl(LSIState *s)
280 {
281 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
282 }
283
284 static void lsi_soft_reset(LSIState *s)
285 {
286 DPRINTF("Reset\n");
287 s->carry = 0;
288
289 s->waiting = 0;
290 s->dsa = 0;
291 s->dnad = 0;
292 s->dbc = 0;
293 s->temp = 0;
294 memset(s->scratch, 0, sizeof(s->scratch));
295 s->istat0 = 0;
296 s->istat1 = 0;
297 s->dcmd = 0;
298 s->dstat = 0;
299 s->dien = 0;
300 s->sist0 = 0;
301 s->sist1 = 0;
302 s->sien0 = 0;
303 s->sien1 = 0;
304 s->mbox0 = 0;
305 s->mbox1 = 0;
306 s->dfifo = 0;
307 s->ctest2 = 0;
308 s->ctest3 = 0;
309 s->ctest4 = 0;
310 s->ctest5 = 0;
311 s->ccntl0 = 0;
312 s->ccntl1 = 0;
313 s->dsp = 0;
314 s->dsps = 0;
315 s->dmode = 0;
316 s->dcntl = 0;
317 s->scntl0 = 0xc0;
318 s->scntl1 = 0;
319 s->scntl2 = 0;
320 s->scntl3 = 0;
321 s->sstat0 = 0;
322 s->sstat1 = 0;
323 s->scid = 7;
324 s->sxfer = 0;
325 s->socl = 0;
326 s->stest1 = 0;
327 s->stest2 = 0;
328 s->stest3 = 0;
329 s->sidl = 0;
330 s->stime0 = 0;
331 s->respid0 = 0x80;
332 s->respid1 = 0;
333 s->mmrs = 0;
334 s->mmws = 0;
335 s->sfs = 0;
336 s->drs = 0;
337 s->sbms = 0;
338 s->dbms = 0;
339 s->dnad64 = 0;
340 s->pmjad1 = 0;
341 s->pmjad2 = 0;
342 s->rbc = 0;
343 s->ua = 0;
344 s->ia = 0;
345 s->sbc = 0;
346 s->csbc = 0;
347 s->sbr = 0;
348 }
349
350 static int lsi_dma_40bit(LSIState *s)
351 {
352 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
353 return 1;
354 return 0;
355 }
356
357 static int lsi_dma_ti64bit(LSIState *s)
358 {
359 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
360 return 1;
361 return 0;
362 }
363
364 static int lsi_dma_64bit(LSIState *s)
365 {
366 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
367 return 1;
368 return 0;
369 }
370
371 static uint8_t lsi_reg_readb(LSIState *s, int offset);
372 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
373 static void lsi_execute_script(LSIState *s);
374 static void lsi_reselect(LSIState *s, lsi_request *p);
375
376 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
377 {
378 uint32_t buf;
379
380 /* Optimize reading from SCRIPTS RAM. */
381 if ((addr & 0xffffe000) == s->script_ram_base) {
382 return s->script_ram[(addr & 0x1fff) >> 2];
383 }
384 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
385 return cpu_to_le32(buf);
386 }
387
388 static void lsi_stop_script(LSIState *s)
389 {
390 s->istat1 &= ~LSI_ISTAT1_SRUN;
391 }
392
393 static void lsi_update_irq(LSIState *s)
394 {
395 int level;
396 static int last_level;
397 lsi_request *p;
398
399 /* It's unclear whether the DIP/SIP bits should be cleared when the
400 Interrupt Status Registers are cleared or when istat0 is read.
401 We currently do the formwer, which seems to work. */
402 level = 0;
403 if (s->dstat) {
404 if (s->dstat & s->dien)
405 level = 1;
406 s->istat0 |= LSI_ISTAT0_DIP;
407 } else {
408 s->istat0 &= ~LSI_ISTAT0_DIP;
409 }
410
411 if (s->sist0 || s->sist1) {
412 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
413 level = 1;
414 s->istat0 |= LSI_ISTAT0_SIP;
415 } else {
416 s->istat0 &= ~LSI_ISTAT0_SIP;
417 }
418 if (s->istat0 & LSI_ISTAT0_INTF)
419 level = 1;
420
421 if (level != last_level) {
422 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
423 level, s->dstat, s->sist1, s->sist0);
424 last_level = level;
425 }
426 qemu_set_irq(s->dev.irq[0], level);
427
428 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
429 DPRINTF("Handled IRQs & disconnected, looking for pending "
430 "processes\n");
431 QTAILQ_FOREACH(p, &s->queue, next) {
432 if (p->pending) {
433 lsi_reselect(s, p);
434 break;
435 }
436 }
437 }
438 }
439
440 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
441 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
442 {
443 uint32_t mask0;
444 uint32_t mask1;
445
446 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
447 stat1, stat0, s->sist1, s->sist0);
448 s->sist0 |= stat0;
449 s->sist1 |= stat1;
450 /* Stop processor on fatal or unmasked interrupt. As a special hack
451 we don't stop processing when raising STO. Instead continue
452 execution and stop at the next insn that accesses the SCSI bus. */
453 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
454 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
455 mask1 &= ~LSI_SIST1_STO;
456 if (s->sist0 & mask0 || s->sist1 & mask1) {
457 lsi_stop_script(s);
458 }
459 lsi_update_irq(s);
460 }
461
462 /* Stop SCRIPTS execution and raise a DMA interrupt. */
463 static void lsi_script_dma_interrupt(LSIState *s, int stat)
464 {
465 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
466 s->dstat |= stat;
467 lsi_update_irq(s);
468 lsi_stop_script(s);
469 }
470
471 static inline void lsi_set_phase(LSIState *s, int phase)
472 {
473 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
474 }
475
476 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
477 {
478 /* Trigger a phase mismatch. */
479 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
480 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
481 s->dsp = s->pmjad1;
482 } else {
483 s->dsp = s->pmjad2;
484 }
485 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
486 } else {
487 DPRINTF("Phase mismatch interrupt\n");
488 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
489 lsi_stop_script(s);
490 }
491 lsi_set_phase(s, new_phase);
492 }
493
494
495 /* Resume SCRIPTS execution after a DMA operation. */
496 static void lsi_resume_script(LSIState *s)
497 {
498 if (s->waiting != 2) {
499 s->waiting = 0;
500 lsi_execute_script(s);
501 } else {
502 s->waiting = 0;
503 }
504 }
505
506 /* Initiate a SCSI layer data transfer. */
507 static void lsi_do_dma(LSIState *s, int out)
508 {
509 uint32_t count;
510 target_phys_addr_t addr;
511
512 assert(s->current);
513 if (!s->current->dma_len) {
514 /* Wait until data is available. */
515 DPRINTF("DMA no data available\n");
516 return;
517 }
518
519 count = s->dbc;
520 if (count > s->current->dma_len)
521 count = s->current->dma_len;
522
523 addr = s->dnad;
524 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
525 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
526 addr |= ((uint64_t)s->dnad64 << 32);
527 else if (s->dbms)
528 addr |= ((uint64_t)s->dbms << 32);
529 else if (s->sbms)
530 addr |= ((uint64_t)s->sbms << 32);
531
532 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
533 s->csbc += count;
534 s->dnad += count;
535 s->dbc -= count;
536
537 if (s->current->dma_buf == NULL) {
538 s->current->dma_buf = s->current->dev->info->get_buf(s->current->dev,
539 s->current->tag);
540 }
541
542 /* ??? Set SFBR to first data byte. */
543 if (out) {
544 cpu_physical_memory_read(addr, s->current->dma_buf, count);
545 } else {
546 cpu_physical_memory_write(addr, s->current->dma_buf, count);
547 }
548 s->current->dma_len -= count;
549 if (s->current->dma_len == 0) {
550 s->current->dma_buf = NULL;
551 if (out) {
552 /* Write the data. */
553 s->current->dev->info->write_data(s->current->dev, s->current->tag);
554 } else {
555 /* Request any remaining data. */
556 s->current->dev->info->read_data(s->current->dev, s->current->tag);
557 }
558 } else {
559 s->current->dma_buf += count;
560 lsi_resume_script(s);
561 }
562 }
563
564
565 /* Add a command to the queue. */
566 static void lsi_queue_command(LSIState *s)
567 {
568 lsi_request *p = s->current;
569
570 DPRINTF("Queueing tag=0x%x\n", s->current_tag);
571 assert(s->current != NULL);
572 assert(s->current->dma_len == 0);
573 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
574 s->current = NULL;
575
576 p->pending = 0;
577 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
578 }
579
580 /* Queue a byte for a MSG IN phase. */
581 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
582 {
583 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
584 BADF("MSG IN data too long\n");
585 } else {
586 DPRINTF("MSG IN 0x%02x\n", data);
587 s->msg[s->msg_len++] = data;
588 }
589 }
590
591 /* Perform reselection to continue a command. */
592 static void lsi_reselect(LSIState *s, lsi_request *p)
593 {
594 int id;
595
596 assert(s->current == NULL);
597 QTAILQ_REMOVE(&s->queue, p, next);
598 s->current = p;
599
600 id = (p->tag >> 8) & 0xf;
601 s->ssid = id | 0x80;
602 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
603 if (!(s->dcntl & LSI_DCNTL_COM)) {
604 s->sfbr = 1 << (id & 0x7);
605 }
606 DPRINTF("Reselected target %d\n", id);
607 s->scntl1 |= LSI_SCNTL1_CON;
608 lsi_set_phase(s, PHASE_MI);
609 s->msg_action = p->out ? 2 : 3;
610 s->current->dma_len = p->pending;
611 lsi_add_msg_byte(s, 0x80);
612 if (s->current->tag & LSI_TAG_VALID) {
613 lsi_add_msg_byte(s, 0x20);
614 lsi_add_msg_byte(s, p->tag & 0xff);
615 }
616
617 if (lsi_irq_on_rsl(s)) {
618 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
619 }
620 }
621
622 /* Record that data is available for a queued command. Returns zero if
623 the device was reselected, nonzero if the IO is deferred. */
624 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
625 {
626 lsi_request *p;
627
628 QTAILQ_FOREACH(p, &s->queue, next) {
629 if (p->tag == tag) {
630 if (p->pending) {
631 BADF("Multiple IO pending for tag %d\n", tag);
632 }
633 p->pending = arg;
634 /* Reselect if waiting for it, or if reselection triggers an IRQ
635 and the bus is free.
636 Since no interrupt stacking is implemented in the emulation, it
637 is also required that there are no pending interrupts waiting
638 for service from the device driver. */
639 if (s->waiting == 1 ||
640 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
641 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
642 /* Reselect device. */
643 lsi_reselect(s, p);
644 return 0;
645 } else {
646 DPRINTF("Queueing IO tag=0x%x\n", tag);
647 p->pending = arg;
648 return 1;
649 }
650 }
651 }
652 BADF("IO with unknown tag %d\n", tag);
653 return 1;
654 }
655
656 /* Callback to indicate that the SCSI layer has completed a transfer. */
657 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
658 uint32_t arg)
659 {
660 LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
661 int out;
662
663 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
664 if (reason == SCSI_REASON_DONE) {
665 DPRINTF("Command complete sense=%d\n", (int)arg);
666 s->sense = arg;
667 s->command_complete = 2;
668 if (s->waiting && s->dbc != 0) {
669 /* Raise phase mismatch for short transfers. */
670 lsi_bad_phase(s, out, PHASE_ST);
671 } else {
672 lsi_set_phase(s, PHASE_ST);
673 }
674
675 qemu_free(s->current);
676 s->current = NULL;
677
678 lsi_resume_script(s);
679 return;
680 }
681
682 if (s->waiting == 1 || tag != s->current->tag ||
683 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
684 if (lsi_queue_tag(s, tag, arg))
685 return;
686 }
687
688 /* host adapter (re)connected */
689 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
690 s->current->dma_len = arg;
691 s->command_complete = 1;
692 if (!s->waiting)
693 return;
694 if (s->waiting == 1 || s->dbc == 0) {
695 lsi_resume_script(s);
696 } else {
697 lsi_do_dma(s, out);
698 }
699 }
700
701 static void lsi_do_command(LSIState *s)
702 {
703 uint8_t buf[16];
704 int n;
705
706 DPRINTF("Send command len=%d\n", s->dbc);
707 if (s->dbc > 16)
708 s->dbc = 16;
709 cpu_physical_memory_read(s->dnad, buf, s->dbc);
710 s->sfbr = buf[0];
711 s->command_complete = 0;
712
713 assert(s->current == NULL);
714 s->current = qemu_mallocz(sizeof(lsi_request));
715 s->current->tag = s->select_tag;
716 s->current->dev = s->select_dev;
717
718 n = s->current->dev->info->send_command(s->current->dev, s->current->tag, buf,
719 s->current_lun);
720 if (n > 0) {
721 lsi_set_phase(s, PHASE_DI);
722 s->current->dev->info->read_data(s->current->dev, s->current->tag);
723 } else if (n < 0) {
724 lsi_set_phase(s, PHASE_DO);
725 s->current->dev->info->write_data(s->current->dev, s->current->tag);
726 }
727
728 if (!s->command_complete) {
729 if (n) {
730 /* Command did not complete immediately so disconnect. */
731 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
732 lsi_add_msg_byte(s, 4); /* DISCONNECT */
733 /* wait data */
734 lsi_set_phase(s, PHASE_MI);
735 s->msg_action = 1;
736 lsi_queue_command(s);
737 } else {
738 /* wait command complete */
739 lsi_set_phase(s, PHASE_DI);
740 }
741 }
742 }
743
744 static void lsi_do_status(LSIState *s)
745 {
746 uint8_t sense;
747 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
748 if (s->dbc != 1)
749 BADF("Bad Status move\n");
750 s->dbc = 1;
751 sense = s->sense;
752 s->sfbr = sense;
753 cpu_physical_memory_write(s->dnad, &sense, 1);
754 lsi_set_phase(s, PHASE_MI);
755 s->msg_action = 1;
756 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
757 }
758
759 static void lsi_disconnect(LSIState *s)
760 {
761 s->scntl1 &= ~LSI_SCNTL1_CON;
762 s->sstat1 &= ~PHASE_MASK;
763 }
764
765 static void lsi_do_msgin(LSIState *s)
766 {
767 int len;
768 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
769 s->sfbr = s->msg[0];
770 len = s->msg_len;
771 if (len > s->dbc)
772 len = s->dbc;
773 cpu_physical_memory_write(s->dnad, s->msg, len);
774 /* Linux drivers rely on the last byte being in the SIDL. */
775 s->sidl = s->msg[len - 1];
776 s->msg_len -= len;
777 if (s->msg_len) {
778 memmove(s->msg, s->msg + len, s->msg_len);
779 } else {
780 /* ??? Check if ATN (not yet implemented) is asserted and maybe
781 switch to PHASE_MO. */
782 switch (s->msg_action) {
783 case 0:
784 lsi_set_phase(s, PHASE_CMD);
785 break;
786 case 1:
787 lsi_disconnect(s);
788 break;
789 case 2:
790 lsi_set_phase(s, PHASE_DO);
791 break;
792 case 3:
793 lsi_set_phase(s, PHASE_DI);
794 break;
795 default:
796 abort();
797 }
798 }
799 }
800
801 /* Read the next byte during a MSGOUT phase. */
802 static uint8_t lsi_get_msgbyte(LSIState *s)
803 {
804 uint8_t data;
805 cpu_physical_memory_read(s->dnad, &data, 1);
806 s->dnad++;
807 s->dbc--;
808 return data;
809 }
810
811 static void lsi_do_msgout(LSIState *s)
812 {
813 uint8_t msg;
814 int len;
815
816 DPRINTF("MSG out len=%d\n", s->dbc);
817 while (s->dbc) {
818 msg = lsi_get_msgbyte(s);
819 s->sfbr = msg;
820
821 switch (msg) {
822 case 0x04:
823 DPRINTF("MSG: Disconnect\n");
824 lsi_disconnect(s);
825 break;
826 case 0x08:
827 DPRINTF("MSG: No Operation\n");
828 lsi_set_phase(s, PHASE_CMD);
829 break;
830 case 0x01:
831 len = lsi_get_msgbyte(s);
832 msg = lsi_get_msgbyte(s);
833 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
834 switch (msg) {
835 case 1:
836 DPRINTF("SDTR (ignored)\n");
837 s->dbc -= 2;
838 break;
839 case 3:
840 DPRINTF("WDTR (ignored)\n");
841 s->dbc -= 1;
842 break;
843 default:
844 goto bad;
845 }
846 break;
847 case 0x20: /* SIMPLE queue */
848 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
849 DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
850 break;
851 case 0x21: /* HEAD of queue */
852 BADF("HEAD queue not implemented\n");
853 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
854 break;
855 case 0x22: /* ORDERED queue */
856 BADF("ORDERED queue not implemented\n");
857 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
858 break;
859 default:
860 if ((msg & 0x80) == 0) {
861 goto bad;
862 }
863 s->current_lun = msg & 7;
864 DPRINTF("Select LUN %d\n", s->current_lun);
865 lsi_set_phase(s, PHASE_CMD);
866 break;
867 }
868 }
869 return;
870 bad:
871 BADF("Unimplemented message 0x%02x\n", msg);
872 lsi_set_phase(s, PHASE_MI);
873 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
874 s->msg_action = 0;
875 }
876
877 /* Sign extend a 24-bit value. */
878 static inline int32_t sxt24(int32_t n)
879 {
880 return (n << 8) >> 8;
881 }
882
883 #define LSI_BUF_SIZE 4096
884 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
885 {
886 int n;
887 uint8_t buf[LSI_BUF_SIZE];
888
889 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
890 while (count) {
891 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
892 cpu_physical_memory_read(src, buf, n);
893 cpu_physical_memory_write(dest, buf, n);
894 src += n;
895 dest += n;
896 count -= n;
897 }
898 }
899
900 static void lsi_wait_reselect(LSIState *s)
901 {
902 lsi_request *p;
903
904 DPRINTF("Wait Reselect\n");
905
906 QTAILQ_FOREACH(p, &s->queue, next) {
907 if (p->pending) {
908 lsi_reselect(s, p);
909 break;
910 }
911 }
912 if (s->current == NULL) {
913 s->waiting = 1;
914 }
915 }
916
917 static void lsi_execute_script(LSIState *s)
918 {
919 uint32_t insn;
920 uint32_t addr, addr_high;
921 int opcode;
922 int insn_processed = 0;
923
924 s->istat1 |= LSI_ISTAT1_SRUN;
925 again:
926 insn_processed++;
927 insn = read_dword(s, s->dsp);
928 if (!insn) {
929 /* If we receive an empty opcode increment the DSP by 4 bytes
930 instead of 8 and execute the next opcode at that location */
931 s->dsp += 4;
932 goto again;
933 }
934 addr = read_dword(s, s->dsp + 4);
935 addr_high = 0;
936 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
937 s->dsps = addr;
938 s->dcmd = insn >> 24;
939 s->dsp += 8;
940 switch (insn >> 30) {
941 case 0: /* Block move. */
942 if (s->sist1 & LSI_SIST1_STO) {
943 DPRINTF("Delayed select timeout\n");
944 lsi_stop_script(s);
945 break;
946 }
947 s->dbc = insn & 0xffffff;
948 s->rbc = s->dbc;
949 /* ??? Set ESA. */
950 s->ia = s->dsp - 8;
951 if (insn & (1 << 29)) {
952 /* Indirect addressing. */
953 addr = read_dword(s, addr);
954 } else if (insn & (1 << 28)) {
955 uint32_t buf[2];
956 int32_t offset;
957 /* Table indirect addressing. */
958
959 /* 32-bit Table indirect */
960 offset = sxt24(addr);
961 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
962 /* byte count is stored in bits 0:23 only */
963 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
964 s->rbc = s->dbc;
965 addr = cpu_to_le32(buf[1]);
966
967 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
968 * table, bits [31:24] */
969 if (lsi_dma_40bit(s))
970 addr_high = cpu_to_le32(buf[0]) >> 24;
971 else if (lsi_dma_ti64bit(s)) {
972 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
973 switch (selector) {
974 case 0 ... 0x0f:
975 /* offset index into scratch registers since
976 * TI64 mode can use registers C to R */
977 addr_high = s->scratch[2 + selector];
978 break;
979 case 0x10:
980 addr_high = s->mmrs;
981 break;
982 case 0x11:
983 addr_high = s->mmws;
984 break;
985 case 0x12:
986 addr_high = s->sfs;
987 break;
988 case 0x13:
989 addr_high = s->drs;
990 break;
991 case 0x14:
992 addr_high = s->sbms;
993 break;
994 case 0x15:
995 addr_high = s->dbms;
996 break;
997 default:
998 BADF("Illegal selector specified (0x%x > 0x15)"
999 " for 64-bit DMA block move", selector);
1000 break;
1001 }
1002 }
1003 } else if (lsi_dma_64bit(s)) {
1004 /* fetch a 3rd dword if 64-bit direct move is enabled and
1005 only if we're not doing table indirect or indirect addressing */
1006 s->dbms = read_dword(s, s->dsp);
1007 s->dsp += 4;
1008 s->ia = s->dsp - 12;
1009 }
1010 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1011 DPRINTF("Wrong phase got %d expected %d\n",
1012 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1013 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1014 break;
1015 }
1016 s->dnad = addr;
1017 s->dnad64 = addr_high;
1018 switch (s->sstat1 & 0x7) {
1019 case PHASE_DO:
1020 s->waiting = 2;
1021 lsi_do_dma(s, 1);
1022 if (s->waiting)
1023 s->waiting = 3;
1024 break;
1025 case PHASE_DI:
1026 s->waiting = 2;
1027 lsi_do_dma(s, 0);
1028 if (s->waiting)
1029 s->waiting = 3;
1030 break;
1031 case PHASE_CMD:
1032 lsi_do_command(s);
1033 break;
1034 case PHASE_ST:
1035 lsi_do_status(s);
1036 break;
1037 case PHASE_MO:
1038 lsi_do_msgout(s);
1039 break;
1040 case PHASE_MI:
1041 lsi_do_msgin(s);
1042 break;
1043 default:
1044 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1045 exit(1);
1046 }
1047 s->dfifo = s->dbc & 0xff;
1048 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1049 s->sbc = s->dbc;
1050 s->rbc -= s->dbc;
1051 s->ua = addr + s->dbc;
1052 break;
1053
1054 case 1: /* IO or Read/Write instruction. */
1055 opcode = (insn >> 27) & 7;
1056 if (opcode < 5) {
1057 uint32_t id;
1058
1059 if (insn & (1 << 25)) {
1060 id = read_dword(s, s->dsa + sxt24(insn));
1061 } else {
1062 id = insn;
1063 }
1064 id = (id >> 16) & 0xf;
1065 if (insn & (1 << 26)) {
1066 addr = s->dsp + sxt24(addr);
1067 }
1068 s->dnad = addr;
1069 switch (opcode) {
1070 case 0: /* Select */
1071 s->sdid = id;
1072 if (s->scntl1 & LSI_SCNTL1_CON) {
1073 DPRINTF("Already reselected, jumping to alternative address\n");
1074 s->dsp = s->dnad;
1075 break;
1076 }
1077 s->sstat0 |= LSI_SSTAT0_WOA;
1078 s->scntl1 &= ~LSI_SCNTL1_IARB;
1079 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1080 DPRINTF("Selected absent target %d\n", id);
1081 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1082 lsi_disconnect(s);
1083 break;
1084 }
1085 DPRINTF("Selected target %d%s\n",
1086 id, insn & (1 << 3) ? " ATN" : "");
1087 /* ??? Linux drivers compain when this is set. Maybe
1088 it only applies in low-level mode (unimplemented).
1089 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1090 s->select_dev = s->bus.devs[id];
1091 s->select_tag = id << 8;
1092 s->scntl1 |= LSI_SCNTL1_CON;
1093 if (insn & (1 << 3)) {
1094 s->socl |= LSI_SOCL_ATN;
1095 }
1096 lsi_set_phase(s, PHASE_MO);
1097 break;
1098 case 1: /* Disconnect */
1099 DPRINTF("Wait Disconnect\n");
1100 s->scntl1 &= ~LSI_SCNTL1_CON;
1101 break;
1102 case 2: /* Wait Reselect */
1103 if (!lsi_irq_on_rsl(s)) {
1104 lsi_wait_reselect(s);
1105 }
1106 break;
1107 case 3: /* Set */
1108 DPRINTF("Set%s%s%s%s\n",
1109 insn & (1 << 3) ? " ATN" : "",
1110 insn & (1 << 6) ? " ACK" : "",
1111 insn & (1 << 9) ? " TM" : "",
1112 insn & (1 << 10) ? " CC" : "");
1113 if (insn & (1 << 3)) {
1114 s->socl |= LSI_SOCL_ATN;
1115 lsi_set_phase(s, PHASE_MO);
1116 }
1117 if (insn & (1 << 9)) {
1118 BADF("Target mode not implemented\n");
1119 exit(1);
1120 }
1121 if (insn & (1 << 10))
1122 s->carry = 1;
1123 break;
1124 case 4: /* Clear */
1125 DPRINTF("Clear%s%s%s%s\n",
1126 insn & (1 << 3) ? " ATN" : "",
1127 insn & (1 << 6) ? " ACK" : "",
1128 insn & (1 << 9) ? " TM" : "",
1129 insn & (1 << 10) ? " CC" : "");
1130 if (insn & (1 << 3)) {
1131 s->socl &= ~LSI_SOCL_ATN;
1132 }
1133 if (insn & (1 << 10))
1134 s->carry = 0;
1135 break;
1136 }
1137 } else {
1138 uint8_t op0;
1139 uint8_t op1;
1140 uint8_t data8;
1141 int reg;
1142 int operator;
1143 #ifdef DEBUG_LSI
1144 static const char *opcode_names[3] =
1145 {"Write", "Read", "Read-Modify-Write"};
1146 static const char *operator_names[8] =
1147 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1148 #endif
1149
1150 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1151 data8 = (insn >> 8) & 0xff;
1152 opcode = (insn >> 27) & 7;
1153 operator = (insn >> 24) & 7;
1154 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1155 opcode_names[opcode - 5], reg,
1156 operator_names[operator], data8, s->sfbr,
1157 (insn & (1 << 23)) ? " SFBR" : "");
1158 op0 = op1 = 0;
1159 switch (opcode) {
1160 case 5: /* From SFBR */
1161 op0 = s->sfbr;
1162 op1 = data8;
1163 break;
1164 case 6: /* To SFBR */
1165 if (operator)
1166 op0 = lsi_reg_readb(s, reg);
1167 op1 = data8;
1168 break;
1169 case 7: /* Read-modify-write */
1170 if (operator)
1171 op0 = lsi_reg_readb(s, reg);
1172 if (insn & (1 << 23)) {
1173 op1 = s->sfbr;
1174 } else {
1175 op1 = data8;
1176 }
1177 break;
1178 }
1179
1180 switch (operator) {
1181 case 0: /* move */
1182 op0 = op1;
1183 break;
1184 case 1: /* Shift left */
1185 op1 = op0 >> 7;
1186 op0 = (op0 << 1) | s->carry;
1187 s->carry = op1;
1188 break;
1189 case 2: /* OR */
1190 op0 |= op1;
1191 break;
1192 case 3: /* XOR */
1193 op0 ^= op1;
1194 break;
1195 case 4: /* AND */
1196 op0 &= op1;
1197 break;
1198 case 5: /* SHR */
1199 op1 = op0 & 1;
1200 op0 = (op0 >> 1) | (s->carry << 7);
1201 s->carry = op1;
1202 break;
1203 case 6: /* ADD */
1204 op0 += op1;
1205 s->carry = op0 < op1;
1206 break;
1207 case 7: /* ADC */
1208 op0 += op1 + s->carry;
1209 if (s->carry)
1210 s->carry = op0 <= op1;
1211 else
1212 s->carry = op0 < op1;
1213 break;
1214 }
1215
1216 switch (opcode) {
1217 case 5: /* From SFBR */
1218 case 7: /* Read-modify-write */
1219 lsi_reg_writeb(s, reg, op0);
1220 break;
1221 case 6: /* To SFBR */
1222 s->sfbr = op0;
1223 break;
1224 }
1225 }
1226 break;
1227
1228 case 2: /* Transfer Control. */
1229 {
1230 int cond;
1231 int jmp;
1232
1233 if ((insn & 0x002e0000) == 0) {
1234 DPRINTF("NOP\n");
1235 break;
1236 }
1237 if (s->sist1 & LSI_SIST1_STO) {
1238 DPRINTF("Delayed select timeout\n");
1239 lsi_stop_script(s);
1240 break;
1241 }
1242 cond = jmp = (insn & (1 << 19)) != 0;
1243 if (cond == jmp && (insn & (1 << 21))) {
1244 DPRINTF("Compare carry %d\n", s->carry == jmp);
1245 cond = s->carry != 0;
1246 }
1247 if (cond == jmp && (insn & (1 << 17))) {
1248 DPRINTF("Compare phase %d %c= %d\n",
1249 (s->sstat1 & PHASE_MASK),
1250 jmp ? '=' : '!',
1251 ((insn >> 24) & 7));
1252 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1253 }
1254 if (cond == jmp && (insn & (1 << 18))) {
1255 uint8_t mask;
1256
1257 mask = (~insn >> 8) & 0xff;
1258 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1259 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1260 cond = (s->sfbr & mask) == (insn & mask);
1261 }
1262 if (cond == jmp) {
1263 if (insn & (1 << 23)) {
1264 /* Relative address. */
1265 addr = s->dsp + sxt24(addr);
1266 }
1267 switch ((insn >> 27) & 7) {
1268 case 0: /* Jump */
1269 DPRINTF("Jump to 0x%08x\n", addr);
1270 s->dsp = addr;
1271 break;
1272 case 1: /* Call */
1273 DPRINTF("Call 0x%08x\n", addr);
1274 s->temp = s->dsp;
1275 s->dsp = addr;
1276 break;
1277 case 2: /* Return */
1278 DPRINTF("Return to 0x%08x\n", s->temp);
1279 s->dsp = s->temp;
1280 break;
1281 case 3: /* Interrupt */
1282 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1283 if ((insn & (1 << 20)) != 0) {
1284 s->istat0 |= LSI_ISTAT0_INTF;
1285 lsi_update_irq(s);
1286 } else {
1287 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1288 }
1289 break;
1290 default:
1291 DPRINTF("Illegal transfer control\n");
1292 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1293 break;
1294 }
1295 } else {
1296 DPRINTF("Control condition failed\n");
1297 }
1298 }
1299 break;
1300
1301 case 3:
1302 if ((insn & (1 << 29)) == 0) {
1303 /* Memory move. */
1304 uint32_t dest;
1305 /* ??? The docs imply the destination address is loaded into
1306 the TEMP register. However the Linux drivers rely on
1307 the value being presrved. */
1308 dest = read_dword(s, s->dsp);
1309 s->dsp += 4;
1310 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1311 } else {
1312 uint8_t data[7];
1313 int reg;
1314 int n;
1315 int i;
1316
1317 if (insn & (1 << 28)) {
1318 addr = s->dsa + sxt24(addr);
1319 }
1320 n = (insn & 7);
1321 reg = (insn >> 16) & 0xff;
1322 if (insn & (1 << 24)) {
1323 cpu_physical_memory_read(addr, data, n);
1324 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1325 addr, *(int *)data);
1326 for (i = 0; i < n; i++) {
1327 lsi_reg_writeb(s, reg + i, data[i]);
1328 }
1329 } else {
1330 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1331 for (i = 0; i < n; i++) {
1332 data[i] = lsi_reg_readb(s, reg + i);
1333 }
1334 cpu_physical_memory_write(addr, data, n);
1335 }
1336 }
1337 }
1338 if (insn_processed > 10000 && !s->waiting) {
1339 /* Some windows drivers make the device spin waiting for a memory
1340 location to change. If we have been executed a lot of code then
1341 assume this is the case and force an unexpected device disconnect.
1342 This is apparently sufficient to beat the drivers into submission.
1343 */
1344 if (!(s->sien0 & LSI_SIST0_UDC))
1345 fprintf(stderr, "inf. loop with UDC masked\n");
1346 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1347 lsi_disconnect(s);
1348 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1349 if (s->dcntl & LSI_DCNTL_SSM) {
1350 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1351 } else {
1352 goto again;
1353 }
1354 }
1355 DPRINTF("SCRIPTS execution stopped\n");
1356 }
1357
1358 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1359 {
1360 uint8_t tmp;
1361 #define CASE_GET_REG24(name, addr) \
1362 case addr: return s->name & 0xff; \
1363 case addr + 1: return (s->name >> 8) & 0xff; \
1364 case addr + 2: return (s->name >> 16) & 0xff;
1365
1366 #define CASE_GET_REG32(name, addr) \
1367 case addr: return s->name & 0xff; \
1368 case addr + 1: return (s->name >> 8) & 0xff; \
1369 case addr + 2: return (s->name >> 16) & 0xff; \
1370 case addr + 3: return (s->name >> 24) & 0xff;
1371
1372 #ifdef DEBUG_LSI_REG
1373 DPRINTF("Read reg %x\n", offset);
1374 #endif
1375 switch (offset) {
1376 case 0x00: /* SCNTL0 */
1377 return s->scntl0;
1378 case 0x01: /* SCNTL1 */
1379 return s->scntl1;
1380 case 0x02: /* SCNTL2 */
1381 return s->scntl2;
1382 case 0x03: /* SCNTL3 */
1383 return s->scntl3;
1384 case 0x04: /* SCID */
1385 return s->scid;
1386 case 0x05: /* SXFER */
1387 return s->sxfer;
1388 case 0x06: /* SDID */
1389 return s->sdid;
1390 case 0x07: /* GPREG0 */
1391 return 0x7f;
1392 case 0x08: /* Revision ID */
1393 return 0x00;
1394 case 0xa: /* SSID */
1395 return s->ssid;
1396 case 0xb: /* SBCL */
1397 /* ??? This is not correct. However it's (hopefully) only
1398 used for diagnostics, so should be ok. */
1399 return 0;
1400 case 0xc: /* DSTAT */
1401 tmp = s->dstat | 0x80;
1402 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1403 s->dstat = 0;
1404 lsi_update_irq(s);
1405 return tmp;
1406 case 0x0d: /* SSTAT0 */
1407 return s->sstat0;
1408 case 0x0e: /* SSTAT1 */
1409 return s->sstat1;
1410 case 0x0f: /* SSTAT2 */
1411 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1412 CASE_GET_REG32(dsa, 0x10)
1413 case 0x14: /* ISTAT0 */
1414 return s->istat0;
1415 case 0x15: /* ISTAT1 */
1416 return s->istat1;
1417 case 0x16: /* MBOX0 */
1418 return s->mbox0;
1419 case 0x17: /* MBOX1 */
1420 return s->mbox1;
1421 case 0x18: /* CTEST0 */
1422 return 0xff;
1423 case 0x19: /* CTEST1 */
1424 return 0;
1425 case 0x1a: /* CTEST2 */
1426 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1427 if (s->istat0 & LSI_ISTAT0_SIGP) {
1428 s->istat0 &= ~LSI_ISTAT0_SIGP;
1429 tmp |= LSI_CTEST2_SIGP;
1430 }
1431 return tmp;
1432 case 0x1b: /* CTEST3 */
1433 return s->ctest3;
1434 CASE_GET_REG32(temp, 0x1c)
1435 case 0x20: /* DFIFO */
1436 return 0;
1437 case 0x21: /* CTEST4 */
1438 return s->ctest4;
1439 case 0x22: /* CTEST5 */
1440 return s->ctest5;
1441 case 0x23: /* CTEST6 */
1442 return 0;
1443 CASE_GET_REG24(dbc, 0x24)
1444 case 0x27: /* DCMD */
1445 return s->dcmd;
1446 CASE_GET_REG32(dnad, 0x28)
1447 CASE_GET_REG32(dsp, 0x2c)
1448 CASE_GET_REG32(dsps, 0x30)
1449 CASE_GET_REG32(scratch[0], 0x34)
1450 case 0x38: /* DMODE */
1451 return s->dmode;
1452 case 0x39: /* DIEN */
1453 return s->dien;
1454 case 0x3a: /* SBR */
1455 return s->sbr;
1456 case 0x3b: /* DCNTL */
1457 return s->dcntl;
1458 case 0x40: /* SIEN0 */
1459 return s->sien0;
1460 case 0x41: /* SIEN1 */
1461 return s->sien1;
1462 case 0x42: /* SIST0 */
1463 tmp = s->sist0;
1464 s->sist0 = 0;
1465 lsi_update_irq(s);
1466 return tmp;
1467 case 0x43: /* SIST1 */
1468 tmp = s->sist1;
1469 s->sist1 = 0;
1470 lsi_update_irq(s);
1471 return tmp;
1472 case 0x46: /* MACNTL */
1473 return 0x0f;
1474 case 0x47: /* GPCNTL0 */
1475 return 0x0f;
1476 case 0x48: /* STIME0 */
1477 return s->stime0;
1478 case 0x4a: /* RESPID0 */
1479 return s->respid0;
1480 case 0x4b: /* RESPID1 */
1481 return s->respid1;
1482 case 0x4d: /* STEST1 */
1483 return s->stest1;
1484 case 0x4e: /* STEST2 */
1485 return s->stest2;
1486 case 0x4f: /* STEST3 */
1487 return s->stest3;
1488 case 0x50: /* SIDL */
1489 /* This is needed by the linux drivers. We currently only update it
1490 during the MSG IN phase. */
1491 return s->sidl;
1492 case 0x52: /* STEST4 */
1493 return 0xe0;
1494 case 0x56: /* CCNTL0 */
1495 return s->ccntl0;
1496 case 0x57: /* CCNTL1 */
1497 return s->ccntl1;
1498 case 0x58: /* SBDL */
1499 /* Some drivers peek at the data bus during the MSG IN phase. */
1500 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1501 return s->msg[0];
1502 return 0;
1503 case 0x59: /* SBDL high */
1504 return 0;
1505 CASE_GET_REG32(mmrs, 0xa0)
1506 CASE_GET_REG32(mmws, 0xa4)
1507 CASE_GET_REG32(sfs, 0xa8)
1508 CASE_GET_REG32(drs, 0xac)
1509 CASE_GET_REG32(sbms, 0xb0)
1510 CASE_GET_REG32(dbms, 0xb4)
1511 CASE_GET_REG32(dnad64, 0xb8)
1512 CASE_GET_REG32(pmjad1, 0xc0)
1513 CASE_GET_REG32(pmjad2, 0xc4)
1514 CASE_GET_REG32(rbc, 0xc8)
1515 CASE_GET_REG32(ua, 0xcc)
1516 CASE_GET_REG32(ia, 0xd4)
1517 CASE_GET_REG32(sbc, 0xd8)
1518 CASE_GET_REG32(csbc, 0xdc)
1519 }
1520 if (offset >= 0x5c && offset < 0xa0) {
1521 int n;
1522 int shift;
1523 n = (offset - 0x58) >> 2;
1524 shift = (offset & 3) * 8;
1525 return (s->scratch[n] >> shift) & 0xff;
1526 }
1527 BADF("readb 0x%x\n", offset);
1528 exit(1);
1529 #undef CASE_GET_REG24
1530 #undef CASE_GET_REG32
1531 }
1532
1533 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1534 {
1535 #define CASE_SET_REG24(name, addr) \
1536 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1537 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1538 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1539
1540 #define CASE_SET_REG32(name, addr) \
1541 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1542 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1543 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1544 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1545
1546 #ifdef DEBUG_LSI_REG
1547 DPRINTF("Write reg %x = %02x\n", offset, val);
1548 #endif
1549 switch (offset) {
1550 case 0x00: /* SCNTL0 */
1551 s->scntl0 = val;
1552 if (val & LSI_SCNTL0_START) {
1553 BADF("Start sequence not implemented\n");
1554 }
1555 break;
1556 case 0x01: /* SCNTL1 */
1557 s->scntl1 = val & ~LSI_SCNTL1_SST;
1558 if (val & LSI_SCNTL1_IARB) {
1559 BADF("Immediate Arbritration not implemented\n");
1560 }
1561 if (val & LSI_SCNTL1_RST) {
1562 s->sstat0 |= LSI_SSTAT0_RST;
1563 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1564 } else {
1565 s->sstat0 &= ~LSI_SSTAT0_RST;
1566 }
1567 break;
1568 case 0x02: /* SCNTL2 */
1569 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1570 s->scntl2 = val;
1571 break;
1572 case 0x03: /* SCNTL3 */
1573 s->scntl3 = val;
1574 break;
1575 case 0x04: /* SCID */
1576 s->scid = val;
1577 break;
1578 case 0x05: /* SXFER */
1579 s->sxfer = val;
1580 break;
1581 case 0x06: /* SDID */
1582 if ((val & 0xf) != (s->ssid & 0xf))
1583 BADF("Destination ID does not match SSID\n");
1584 s->sdid = val & 0xf;
1585 break;
1586 case 0x07: /* GPREG0 */
1587 break;
1588 case 0x08: /* SFBR */
1589 /* The CPU is not allowed to write to this register. However the
1590 SCRIPTS register move instructions are. */
1591 s->sfbr = val;
1592 break;
1593 case 0x0a: case 0x0b:
1594 /* Openserver writes to these readonly registers on startup */
1595 return;
1596 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1597 /* Linux writes to these readonly registers on startup. */
1598 return;
1599 CASE_SET_REG32(dsa, 0x10)
1600 case 0x14: /* ISTAT0 */
1601 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1602 if (val & LSI_ISTAT0_ABRT) {
1603 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1604 }
1605 if (val & LSI_ISTAT0_INTF) {
1606 s->istat0 &= ~LSI_ISTAT0_INTF;
1607 lsi_update_irq(s);
1608 }
1609 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1610 DPRINTF("Woken by SIGP\n");
1611 s->waiting = 0;
1612 s->dsp = s->dnad;
1613 lsi_execute_script(s);
1614 }
1615 if (val & LSI_ISTAT0_SRST) {
1616 lsi_soft_reset(s);
1617 }
1618 break;
1619 case 0x16: /* MBOX0 */
1620 s->mbox0 = val;
1621 break;
1622 case 0x17: /* MBOX1 */
1623 s->mbox1 = val;
1624 break;
1625 case 0x1a: /* CTEST2 */
1626 s->ctest2 = val & LSI_CTEST2_PCICIE;
1627 break;
1628 case 0x1b: /* CTEST3 */
1629 s->ctest3 = val & 0x0f;
1630 break;
1631 CASE_SET_REG32(temp, 0x1c)
1632 case 0x21: /* CTEST4 */
1633 if (val & 7) {
1634 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1635 }
1636 s->ctest4 = val;
1637 break;
1638 case 0x22: /* CTEST5 */
1639 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1640 BADF("CTEST5 DMA increment not implemented\n");
1641 }
1642 s->ctest5 = val;
1643 break;
1644 CASE_SET_REG24(dbc, 0x24)
1645 CASE_SET_REG32(dnad, 0x28)
1646 case 0x2c: /* DSP[0:7] */
1647 s->dsp &= 0xffffff00;
1648 s->dsp |= val;
1649 break;
1650 case 0x2d: /* DSP[8:15] */
1651 s->dsp &= 0xffff00ff;
1652 s->dsp |= val << 8;
1653 break;
1654 case 0x2e: /* DSP[16:23] */
1655 s->dsp &= 0xff00ffff;
1656 s->dsp |= val << 16;
1657 break;
1658 case 0x2f: /* DSP[24:31] */
1659 s->dsp &= 0x00ffffff;
1660 s->dsp |= val << 24;
1661 if ((s->dmode & LSI_DMODE_MAN) == 0
1662 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1663 lsi_execute_script(s);
1664 break;
1665 CASE_SET_REG32(dsps, 0x30)
1666 CASE_SET_REG32(scratch[0], 0x34)
1667 case 0x38: /* DMODE */
1668 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1669 BADF("IO mappings not implemented\n");
1670 }
1671 s->dmode = val;
1672 break;
1673 case 0x39: /* DIEN */
1674 s->dien = val;
1675 lsi_update_irq(s);
1676 break;
1677 case 0x3a: /* SBR */
1678 s->sbr = val;
1679 break;
1680 case 0x3b: /* DCNTL */
1681 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1682 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1683 lsi_execute_script(s);
1684 break;
1685 case 0x40: /* SIEN0 */
1686 s->sien0 = val;
1687 lsi_update_irq(s);
1688 break;
1689 case 0x41: /* SIEN1 */
1690 s->sien1 = val;
1691 lsi_update_irq(s);
1692 break;
1693 case 0x47: /* GPCNTL0 */
1694 break;
1695 case 0x48: /* STIME0 */
1696 s->stime0 = val;
1697 break;
1698 case 0x49: /* STIME1 */
1699 if (val & 0xf) {
1700 DPRINTF("General purpose timer not implemented\n");
1701 /* ??? Raising the interrupt immediately seems to be sufficient
1702 to keep the FreeBSD driver happy. */
1703 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1704 }
1705 break;
1706 case 0x4a: /* RESPID0 */
1707 s->respid0 = val;
1708 break;
1709 case 0x4b: /* RESPID1 */
1710 s->respid1 = val;
1711 break;
1712 case 0x4d: /* STEST1 */
1713 s->stest1 = val;
1714 break;
1715 case 0x4e: /* STEST2 */
1716 if (val & 1) {
1717 BADF("Low level mode not implemented\n");
1718 }
1719 s->stest2 = val;
1720 break;
1721 case 0x4f: /* STEST3 */
1722 if (val & 0x41) {
1723 BADF("SCSI FIFO test mode not implemented\n");
1724 }
1725 s->stest3 = val;
1726 break;
1727 case 0x56: /* CCNTL0 */
1728 s->ccntl0 = val;
1729 break;
1730 case 0x57: /* CCNTL1 */
1731 s->ccntl1 = val;
1732 break;
1733 CASE_SET_REG32(mmrs, 0xa0)
1734 CASE_SET_REG32(mmws, 0xa4)
1735 CASE_SET_REG32(sfs, 0xa8)
1736 CASE_SET_REG32(drs, 0xac)
1737 CASE_SET_REG32(sbms, 0xb0)
1738 CASE_SET_REG32(dbms, 0xb4)
1739 CASE_SET_REG32(dnad64, 0xb8)
1740 CASE_SET_REG32(pmjad1, 0xc0)
1741 CASE_SET_REG32(pmjad2, 0xc4)
1742 CASE_SET_REG32(rbc, 0xc8)
1743 CASE_SET_REG32(ua, 0xcc)
1744 CASE_SET_REG32(ia, 0xd4)
1745 CASE_SET_REG32(sbc, 0xd8)
1746 CASE_SET_REG32(csbc, 0xdc)
1747 default:
1748 if (offset >= 0x5c && offset < 0xa0) {
1749 int n;
1750 int shift;
1751 n = (offset - 0x58) >> 2;
1752 shift = (offset & 3) * 8;
1753 s->scratch[n] &= ~(0xff << shift);
1754 s->scratch[n] |= (val & 0xff) << shift;
1755 } else {
1756 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1757 }
1758 }
1759 #undef CASE_SET_REG24
1760 #undef CASE_SET_REG32
1761 }
1762
1763 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1764 {
1765 LSIState *s = opaque;
1766
1767 lsi_reg_writeb(s, addr & 0xff, val);
1768 }
1769
1770 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1771 {
1772 LSIState *s = opaque;
1773
1774 addr &= 0xff;
1775 lsi_reg_writeb(s, addr, val & 0xff);
1776 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1777 }
1778
1779 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1780 {
1781 LSIState *s = opaque;
1782
1783 addr &= 0xff;
1784 lsi_reg_writeb(s, addr, val & 0xff);
1785 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1786 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1787 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1788 }
1789
1790 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1791 {
1792 LSIState *s = opaque;
1793
1794 return lsi_reg_readb(s, addr & 0xff);
1795 }
1796
1797 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1798 {
1799 LSIState *s = opaque;
1800 uint32_t val;
1801
1802 addr &= 0xff;
1803 val = lsi_reg_readb(s, addr);
1804 val |= lsi_reg_readb(s, addr + 1) << 8;
1805 return val;
1806 }
1807
1808 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1809 {
1810 LSIState *s = opaque;
1811 uint32_t val;
1812 addr &= 0xff;
1813 val = lsi_reg_readb(s, addr);
1814 val |= lsi_reg_readb(s, addr + 1) << 8;
1815 val |= lsi_reg_readb(s, addr + 2) << 16;
1816 val |= lsi_reg_readb(s, addr + 3) << 24;
1817 return val;
1818 }
1819
1820 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1821 lsi_mmio_readb,
1822 lsi_mmio_readw,
1823 lsi_mmio_readl,
1824 };
1825
1826 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1827 lsi_mmio_writeb,
1828 lsi_mmio_writew,
1829 lsi_mmio_writel,
1830 };
1831
1832 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1833 {
1834 LSIState *s = opaque;
1835 uint32_t newval;
1836 int shift;
1837
1838 addr &= 0x1fff;
1839 newval = s->script_ram[addr >> 2];
1840 shift = (addr & 3) * 8;
1841 newval &= ~(0xff << shift);
1842 newval |= val << shift;
1843 s->script_ram[addr >> 2] = newval;
1844 }
1845
1846 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1847 {
1848 LSIState *s = opaque;
1849 uint32_t newval;
1850
1851 addr &= 0x1fff;
1852 newval = s->script_ram[addr >> 2];
1853 if (addr & 2) {
1854 newval = (newval & 0xffff) | (val << 16);
1855 } else {
1856 newval = (newval & 0xffff0000) | val;
1857 }
1858 s->script_ram[addr >> 2] = newval;
1859 }
1860
1861
1862 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1863 {
1864 LSIState *s = opaque;
1865
1866 addr &= 0x1fff;
1867 s->script_ram[addr >> 2] = val;
1868 }
1869
1870 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1871 {
1872 LSIState *s = opaque;
1873 uint32_t val;
1874
1875 addr &= 0x1fff;
1876 val = s->script_ram[addr >> 2];
1877 val >>= (addr & 3) * 8;
1878 return val & 0xff;
1879 }
1880
1881 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1882 {
1883 LSIState *s = opaque;
1884 uint32_t val;
1885
1886 addr &= 0x1fff;
1887 val = s->script_ram[addr >> 2];
1888 if (addr & 2)
1889 val >>= 16;
1890 return le16_to_cpu(val);
1891 }
1892
1893 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1894 {
1895 LSIState *s = opaque;
1896
1897 addr &= 0x1fff;
1898 return le32_to_cpu(s->script_ram[addr >> 2]);
1899 }
1900
1901 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1902 lsi_ram_readb,
1903 lsi_ram_readw,
1904 lsi_ram_readl,
1905 };
1906
1907 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1908 lsi_ram_writeb,
1909 lsi_ram_writew,
1910 lsi_ram_writel,
1911 };
1912
1913 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1914 {
1915 LSIState *s = opaque;
1916 return lsi_reg_readb(s, addr & 0xff);
1917 }
1918
1919 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1920 {
1921 LSIState *s = opaque;
1922 uint32_t val;
1923 addr &= 0xff;
1924 val = lsi_reg_readb(s, addr);
1925 val |= lsi_reg_readb(s, addr + 1) << 8;
1926 return val;
1927 }
1928
1929 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1930 {
1931 LSIState *s = opaque;
1932 uint32_t val;
1933 addr &= 0xff;
1934 val = lsi_reg_readb(s, addr);
1935 val |= lsi_reg_readb(s, addr + 1) << 8;
1936 val |= lsi_reg_readb(s, addr + 2) << 16;
1937 val |= lsi_reg_readb(s, addr + 3) << 24;
1938 return val;
1939 }
1940
1941 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1942 {
1943 LSIState *s = opaque;
1944 lsi_reg_writeb(s, addr & 0xff, val);
1945 }
1946
1947 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1948 {
1949 LSIState *s = opaque;
1950 addr &= 0xff;
1951 lsi_reg_writeb(s, addr, val & 0xff);
1952 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1953 }
1954
1955 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1956 {
1957 LSIState *s = opaque;
1958 addr &= 0xff;
1959 lsi_reg_writeb(s, addr, val & 0xff);
1960 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1961 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1962 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1963 }
1964
1965 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1966 pcibus_t addr, pcibus_t size, int type)
1967 {
1968 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1969
1970 DPRINTF("Mapping IO at %08"FMT_PCIBUS"\n", addr);
1971
1972 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1973 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1974 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1975 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1976 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1977 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1978 }
1979
1980 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1981 pcibus_t addr, pcibus_t size, int type)
1982 {
1983 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1984
1985 DPRINTF("Mapping ram at %08"FMT_PCIBUS"\n", addr);
1986 s->script_ram_base = addr;
1987 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1988 }
1989
1990 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1991 pcibus_t addr, pcibus_t size, int type)
1992 {
1993 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1994
1995 DPRINTF("Mapping registers at %08"FMT_PCIBUS"\n", addr);
1996 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1997 }
1998
1999 static void lsi_pre_save(void *opaque)
2000 {
2001 LSIState *s = opaque;
2002
2003 if (s->current) {
2004 assert(s->current->dma_buf == NULL);
2005 assert(s->current->dma_len == 0);
2006 }
2007 assert(QTAILQ_EMPTY(&s->queue));
2008 }
2009
2010 static const VMStateDescription vmstate_lsi_scsi = {
2011 .name = "lsiscsi",
2012 .version_id = 0,
2013 .minimum_version_id = 0,
2014 .minimum_version_id_old = 0,
2015 .pre_save = lsi_pre_save,
2016 .fields = (VMStateField []) {
2017 VMSTATE_PCI_DEVICE(dev, LSIState),
2018
2019 VMSTATE_INT32(carry, LSIState),
2020 VMSTATE_INT32(sense, LSIState),
2021 VMSTATE_INT32(msg_action, LSIState),
2022 VMSTATE_INT32(msg_len, LSIState),
2023 VMSTATE_BUFFER(msg, LSIState),
2024 VMSTATE_INT32(waiting, LSIState),
2025
2026 VMSTATE_UINT32(dsa, LSIState),
2027 VMSTATE_UINT32(temp, LSIState),
2028 VMSTATE_UINT32(dnad, LSIState),
2029 VMSTATE_UINT32(dbc, LSIState),
2030 VMSTATE_UINT8(istat0, LSIState),
2031 VMSTATE_UINT8(istat1, LSIState),
2032 VMSTATE_UINT8(dcmd, LSIState),
2033 VMSTATE_UINT8(dstat, LSIState),
2034 VMSTATE_UINT8(dien, LSIState),
2035 VMSTATE_UINT8(sist0, LSIState),
2036 VMSTATE_UINT8(sist1, LSIState),
2037 VMSTATE_UINT8(sien0, LSIState),
2038 VMSTATE_UINT8(sien1, LSIState),
2039 VMSTATE_UINT8(mbox0, LSIState),
2040 VMSTATE_UINT8(mbox1, LSIState),
2041 VMSTATE_UINT8(dfifo, LSIState),
2042 VMSTATE_UINT8(ctest2, LSIState),
2043 VMSTATE_UINT8(ctest3, LSIState),
2044 VMSTATE_UINT8(ctest4, LSIState),
2045 VMSTATE_UINT8(ctest5, LSIState),
2046 VMSTATE_UINT8(ccntl0, LSIState),
2047 VMSTATE_UINT8(ccntl1, LSIState),
2048 VMSTATE_UINT32(dsp, LSIState),
2049 VMSTATE_UINT32(dsps, LSIState),
2050 VMSTATE_UINT8(dmode, LSIState),
2051 VMSTATE_UINT8(dcntl, LSIState),
2052 VMSTATE_UINT8(scntl0, LSIState),
2053 VMSTATE_UINT8(scntl1, LSIState),
2054 VMSTATE_UINT8(scntl2, LSIState),
2055 VMSTATE_UINT8(scntl3, LSIState),
2056 VMSTATE_UINT8(sstat0, LSIState),
2057 VMSTATE_UINT8(sstat1, LSIState),
2058 VMSTATE_UINT8(scid, LSIState),
2059 VMSTATE_UINT8(sxfer, LSIState),
2060 VMSTATE_UINT8(socl, LSIState),
2061 VMSTATE_UINT8(sdid, LSIState),
2062 VMSTATE_UINT8(ssid, LSIState),
2063 VMSTATE_UINT8(sfbr, LSIState),
2064 VMSTATE_UINT8(stest1, LSIState),
2065 VMSTATE_UINT8(stest2, LSIState),
2066 VMSTATE_UINT8(stest3, LSIState),
2067 VMSTATE_UINT8(sidl, LSIState),
2068 VMSTATE_UINT8(stime0, LSIState),
2069 VMSTATE_UINT8(respid0, LSIState),
2070 VMSTATE_UINT8(respid1, LSIState),
2071 VMSTATE_UINT32(mmrs, LSIState),
2072 VMSTATE_UINT32(mmws, LSIState),
2073 VMSTATE_UINT32(sfs, LSIState),
2074 VMSTATE_UINT32(drs, LSIState),
2075 VMSTATE_UINT32(sbms, LSIState),
2076 VMSTATE_UINT32(dbms, LSIState),
2077 VMSTATE_UINT32(dnad64, LSIState),
2078 VMSTATE_UINT32(pmjad1, LSIState),
2079 VMSTATE_UINT32(pmjad2, LSIState),
2080 VMSTATE_UINT32(rbc, LSIState),
2081 VMSTATE_UINT32(ua, LSIState),
2082 VMSTATE_UINT32(ia, LSIState),
2083 VMSTATE_UINT32(sbc, LSIState),
2084 VMSTATE_UINT32(csbc, LSIState),
2085 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2086 VMSTATE_UINT8(sbr, LSIState),
2087
2088 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2089 VMSTATE_END_OF_LIST()
2090 }
2091 };
2092
2093 static int lsi_scsi_uninit(PCIDevice *d)
2094 {
2095 LSIState *s = DO_UPCAST(LSIState, dev, d);
2096
2097 cpu_unregister_io_memory(s->mmio_io_addr);
2098 cpu_unregister_io_memory(s->ram_io_addr);
2099
2100 return 0;
2101 }
2102
2103 static int lsi_scsi_init(PCIDevice *dev)
2104 {
2105 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2106 uint8_t *pci_conf;
2107
2108 pci_conf = s->dev.config;
2109
2110 /* PCI Vendor ID (word) */
2111 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2112 /* PCI device ID (word) */
2113 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2114 /* PCI base class code */
2115 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2116 /* PCI subsystem ID */
2117 pci_conf[PCI_SUBSYSTEM_ID] = 0x00;
2118 pci_conf[PCI_SUBSYSTEM_ID + 1] = 0x10;
2119 /* PCI latency timer = 255 */
2120 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2121 /* TODO: RST# value should be 0 */
2122 /* Interrupt pin 1 */
2123 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2124
2125 s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2126 lsi_mmio_writefn, s);
2127 s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2128 lsi_ram_writefn, s);
2129
2130 /* TODO: use dev and get rid of cast below */
2131 pci_register_bar((struct PCIDevice *)s, 0, 256,
2132 PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2133 pci_register_bar((struct PCIDevice *)s, 1, 0x400,
2134 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
2135 pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
2136 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2137 QTAILQ_INIT(&s->queue);
2138
2139 lsi_soft_reset(s);
2140
2141 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2142 if (!dev->qdev.hotplugged) {
2143 scsi_bus_legacy_handle_cmdline(&s->bus);
2144 }
2145 return 0;
2146 }
2147
2148 static PCIDeviceInfo lsi_info = {
2149 .qdev.name = "lsi53c895a",
2150 .qdev.alias = "lsi",
2151 .qdev.size = sizeof(LSIState),
2152 .qdev.vmsd = &vmstate_lsi_scsi,
2153 .init = lsi_scsi_init,
2154 .exit = lsi_scsi_uninit,
2155 };
2156
2157 static void lsi53c895a_register_devices(void)
2158 {
2159 pci_qdev_register(&lsi_info);
2160 }
2161
2162 device_init(lsi53c895a_register_devices);
QEmu