?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
monitor: Convert do_physical_memory_save() to QObject
[qemu.git] / hw / lsi53c895a.c
blob3966f2f986309a7e68cefaf05a0e01ed8f8aed43
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licenced under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h> \
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18 #include "scsi-disk.h"
19 #include "block_int.h"
20
21 //#define DEBUG_LSI
22 //#define DEBUG_LSI_REG
23
24 #ifdef DEBUG_LSI
25 #define DPRINTF(fmt, ...) \
26 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
27 #define BADF(fmt, ...) \
28 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
29 #else
30 #define DPRINTF(fmt, ...) do {} while(0)
31 #define BADF(fmt, ...) \
32 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
33 #endif
34
35 #define LSI_SCNTL0_TRG 0x01
36 #define LSI_SCNTL0_AAP 0x02
37 #define LSI_SCNTL0_EPC 0x08
38 #define LSI_SCNTL0_WATN 0x10
39 #define LSI_SCNTL0_START 0x20
40
41 #define LSI_SCNTL1_SST 0x01
42 #define LSI_SCNTL1_IARB 0x02
43 #define LSI_SCNTL1_AESP 0x04
44 #define LSI_SCNTL1_RST 0x08
45 #define LSI_SCNTL1_CON 0x10
46 #define LSI_SCNTL1_DHP 0x20
47 #define LSI_SCNTL1_ADB 0x40
48 #define LSI_SCNTL1_EXC 0x80
49
50 #define LSI_SCNTL2_WSR 0x01
51 #define LSI_SCNTL2_VUE0 0x02
52 #define LSI_SCNTL2_VUE1 0x04
53 #define LSI_SCNTL2_WSS 0x08
54 #define LSI_SCNTL2_SLPHBEN 0x10
55 #define LSI_SCNTL2_SLPMD 0x20
56 #define LSI_SCNTL2_CHM 0x40
57 #define LSI_SCNTL2_SDU 0x80
58
59 #define LSI_ISTAT0_DIP 0x01
60 #define LSI_ISTAT0_SIP 0x02
61 #define LSI_ISTAT0_INTF 0x04
62 #define LSI_ISTAT0_CON 0x08
63 #define LSI_ISTAT0_SEM 0x10
64 #define LSI_ISTAT0_SIGP 0x20
65 #define LSI_ISTAT0_SRST 0x40
66 #define LSI_ISTAT0_ABRT 0x80
67
68 #define LSI_ISTAT1_SI 0x01
69 #define LSI_ISTAT1_SRUN 0x02
70 #define LSI_ISTAT1_FLSH 0x04
71
72 #define LSI_SSTAT0_SDP0 0x01
73 #define LSI_SSTAT0_RST 0x02
74 #define LSI_SSTAT0_WOA 0x04
75 #define LSI_SSTAT0_LOA 0x08
76 #define LSI_SSTAT0_AIP 0x10
77 #define LSI_SSTAT0_OLF 0x20
78 #define LSI_SSTAT0_ORF 0x40
79 #define LSI_SSTAT0_ILF 0x80
80
81 #define LSI_SIST0_PAR 0x01
82 #define LSI_SIST0_RST 0x02
83 #define LSI_SIST0_UDC 0x04
84 #define LSI_SIST0_SGE 0x08
85 #define LSI_SIST0_RSL 0x10
86 #define LSI_SIST0_SEL 0x20
87 #define LSI_SIST0_CMP 0x40
88 #define LSI_SIST0_MA 0x80
89
90 #define LSI_SIST1_HTH 0x01
91 #define LSI_SIST1_GEN 0x02
92 #define LSI_SIST1_STO 0x04
93 #define LSI_SIST1_SBMC 0x10
94
95 #define LSI_SOCL_IO 0x01
96 #define LSI_SOCL_CD 0x02
97 #define LSI_SOCL_MSG 0x04
98 #define LSI_SOCL_ATN 0x08
99 #define LSI_SOCL_SEL 0x10
100 #define LSI_SOCL_BSY 0x20
101 #define LSI_SOCL_ACK 0x40
102 #define LSI_SOCL_REQ 0x80
103
104 #define LSI_DSTAT_IID 0x01
105 #define LSI_DSTAT_SIR 0x04
106 #define LSI_DSTAT_SSI 0x08
107 #define LSI_DSTAT_ABRT 0x10
108 #define LSI_DSTAT_BF 0x20
109 #define LSI_DSTAT_MDPE 0x40
110 #define LSI_DSTAT_DFE 0x80
111
112 #define LSI_DCNTL_COM 0x01
113 #define LSI_DCNTL_IRQD 0x02
114 #define LSI_DCNTL_STD 0x04
115 #define LSI_DCNTL_IRQM 0x08
116 #define LSI_DCNTL_SSM 0x10
117 #define LSI_DCNTL_PFEN 0x20
118 #define LSI_DCNTL_PFF 0x40
119 #define LSI_DCNTL_CLSE 0x80
120
121 #define LSI_DMODE_MAN 0x01
122 #define LSI_DMODE_BOF 0x02
123 #define LSI_DMODE_ERMP 0x04
124 #define LSI_DMODE_ERL 0x08
125 #define LSI_DMODE_DIOM 0x10
126 #define LSI_DMODE_SIOM 0x20
127
128 #define LSI_CTEST2_DACK 0x01
129 #define LSI_CTEST2_DREQ 0x02
130 #define LSI_CTEST2_TEOP 0x04
131 #define LSI_CTEST2_PCICIE 0x08
132 #define LSI_CTEST2_CM 0x10
133 #define LSI_CTEST2_CIO 0x20
134 #define LSI_CTEST2_SIGP 0x40
135 #define LSI_CTEST2_DDIR 0x80
136
137 #define LSI_CTEST5_BL2 0x04
138 #define LSI_CTEST5_DDIR 0x08
139 #define LSI_CTEST5_MASR 0x10
140 #define LSI_CTEST5_DFSN 0x20
141 #define LSI_CTEST5_BBCK 0x40
142 #define LSI_CTEST5_ADCK 0x80
143
144 #define LSI_CCNTL0_DILS 0x01
145 #define LSI_CCNTL0_DISFC 0x10
146 #define LSI_CCNTL0_ENNDJ 0x20
147 #define LSI_CCNTL0_PMJCTL 0x40
148 #define LSI_CCNTL0_ENPMJ 0x80
149
150 #define LSI_CCNTL1_EN64DBMV 0x01
151 #define LSI_CCNTL1_EN64TIBMV 0x02
152 #define LSI_CCNTL1_64TIMOD 0x04
153 #define LSI_CCNTL1_DDAC 0x08
154 #define LSI_CCNTL1_ZMOD 0x80
155
156 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
157
158 #define PHASE_DO 0
159 #define PHASE_DI 1
160 #define PHASE_CMD 2
161 #define PHASE_ST 3
162 #define PHASE_MO 6
163 #define PHASE_MI 7
164 #define PHASE_MASK 7
165
166 /* Maximum length of MSG IN data. */
167 #define LSI_MAX_MSGIN_LEN 8
168
169 /* Flag set if this is a tagged command. */
170 #define LSI_TAG_VALID (1 << 16)
171
172 typedef struct {
173 uint32_t tag;
174 uint32_t pending;
175 int out;
176 } lsi_queue;
177
178 typedef struct {
179 PCIDevice dev;
180 int mmio_io_addr;
181 int ram_io_addr;
182 uint32_t script_ram_base;
183
184 int carry; /* ??? Should this be an a visible register somewhere? */
185 int sense;
186 /* Action to take at the end of a MSG IN phase.
187 0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN. */
188 int msg_action;
189 int msg_len;
190 uint8_t msg[LSI_MAX_MSGIN_LEN];
191 /* 0 if SCRIPTS are running or stopped.
192 * 1 if a Wait Reselect instruction has been issued.
193 * 2 if processing DMA from lsi_execute_script.
194 * 3 if a DMA operation is in progress. */
195 int waiting;
196 SCSIBus bus;
197 SCSIDevice *current_dev;
198 int current_lun;
199 /* The tag is a combination of the device ID and the SCSI tag. */
200 uint32_t current_tag;
201 uint32_t current_dma_len;
202 int command_complete;
203 uint8_t *dma_buf;
204 lsi_queue *queue;
205 int queue_len;
206 int active_commands;
207
208 uint32_t dsa;
209 uint32_t temp;
210 uint32_t dnad;
211 uint32_t dbc;
212 uint8_t istat0;
213 uint8_t istat1;
214 uint8_t dcmd;
215 uint8_t dstat;
216 uint8_t dien;
217 uint8_t sist0;
218 uint8_t sist1;
219 uint8_t sien0;
220 uint8_t sien1;
221 uint8_t mbox0;
222 uint8_t mbox1;
223 uint8_t dfifo;
224 uint8_t ctest2;
225 uint8_t ctest3;
226 uint8_t ctest4;
227 uint8_t ctest5;
228 uint8_t ccntl0;
229 uint8_t ccntl1;
230 uint32_t dsp;
231 uint32_t dsps;
232 uint8_t dmode;
233 uint8_t dcntl;
234 uint8_t scntl0;
235 uint8_t scntl1;
236 uint8_t scntl2;
237 uint8_t scntl3;
238 uint8_t sstat0;
239 uint8_t sstat1;
240 uint8_t scid;
241 uint8_t sxfer;
242 uint8_t socl;
243 uint8_t sdid;
244 uint8_t ssid;
245 uint8_t sfbr;
246 uint8_t stest1;
247 uint8_t stest2;
248 uint8_t stest3;
249 uint8_t sidl;
250 uint8_t stime0;
251 uint8_t respid0;
252 uint8_t respid1;
253 uint32_t mmrs;
254 uint32_t mmws;
255 uint32_t sfs;
256 uint32_t drs;
257 uint32_t sbms;
258 uint32_t dbms;
259 uint32_t dnad64;
260 uint32_t pmjad1;
261 uint32_t pmjad2;
262 uint32_t rbc;
263 uint32_t ua;
264 uint32_t ia;
265 uint32_t sbc;
266 uint32_t csbc;
267 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
268 uint8_t sbr;
269
270 /* Script ram is stored as 32-bit words in host byteorder. */
271 uint32_t script_ram[2048];
272 } LSIState;
273
274 static void lsi_soft_reset(LSIState *s)
275 {
276 DPRINTF("Reset\n");
277 s->carry = 0;
278
279 s->waiting = 0;
280 s->dsa = 0;
281 s->dnad = 0;
282 s->dbc = 0;
283 s->temp = 0;
284 memset(s->scratch, 0, sizeof(s->scratch));
285 s->istat0 = 0;
286 s->istat1 = 0;
287 s->dcmd = 0;
288 s->dstat = 0;
289 s->dien = 0;
290 s->sist0 = 0;
291 s->sist1 = 0;
292 s->sien0 = 0;
293 s->sien1 = 0;
294 s->mbox0 = 0;
295 s->mbox1 = 0;
296 s->dfifo = 0;
297 s->ctest2 = 0;
298 s->ctest3 = 0;
299 s->ctest4 = 0;
300 s->ctest5 = 0;
301 s->ccntl0 = 0;
302 s->ccntl1 = 0;
303 s->dsp = 0;
304 s->dsps = 0;
305 s->dmode = 0;
306 s->dcntl = 0;
307 s->scntl0 = 0xc0;
308 s->scntl1 = 0;
309 s->scntl2 = 0;
310 s->scntl3 = 0;
311 s->sstat0 = 0;
312 s->sstat1 = 0;
313 s->scid = 7;
314 s->sxfer = 0;
315 s->socl = 0;
316 s->stest1 = 0;
317 s->stest2 = 0;
318 s->stest3 = 0;
319 s->sidl = 0;
320 s->stime0 = 0;
321 s->respid0 = 0x80;
322 s->respid1 = 0;
323 s->mmrs = 0;
324 s->mmws = 0;
325 s->sfs = 0;
326 s->drs = 0;
327 s->sbms = 0;
328 s->dbms = 0;
329 s->dnad64 = 0;
330 s->pmjad1 = 0;
331 s->pmjad2 = 0;
332 s->rbc = 0;
333 s->ua = 0;
334 s->ia = 0;
335 s->sbc = 0;
336 s->csbc = 0;
337 s->sbr = 0;
338 }
339
340 static int lsi_dma_40bit(LSIState *s)
341 {
342 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
343 return 1;
344 return 0;
345 }
346
347 static int lsi_dma_ti64bit(LSIState *s)
348 {
349 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
350 return 1;
351 return 0;
352 }
353
354 static int lsi_dma_64bit(LSIState *s)
355 {
356 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
357 return 1;
358 return 0;
359 }
360
361 static uint8_t lsi_reg_readb(LSIState *s, int offset);
362 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
363 static void lsi_execute_script(LSIState *s);
364
365 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
366 {
367 uint32_t buf;
368
369 /* Optimize reading from SCRIPTS RAM. */
370 if ((addr & 0xffffe000) == s->script_ram_base) {
371 return s->script_ram[(addr & 0x1fff) >> 2];
372 }
373 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
374 return cpu_to_le32(buf);
375 }
376
377 static void lsi_stop_script(LSIState *s)
378 {
379 s->istat1 &= ~LSI_ISTAT1_SRUN;
380 }
381
382 static void lsi_update_irq(LSIState *s)
383 {
384 int level;
385 static int last_level;
386
387 /* It's unclear whether the DIP/SIP bits should be cleared when the
388 Interrupt Status Registers are cleared or when istat0 is read.
389 We currently do the formwer, which seems to work. */
390 level = 0;
391 if (s->dstat) {
392 if (s->dstat & s->dien)
393 level = 1;
394 s->istat0 |= LSI_ISTAT0_DIP;
395 } else {
396 s->istat0 &= ~LSI_ISTAT0_DIP;
397 }
398
399 if (s->sist0 || s->sist1) {
400 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
401 level = 1;
402 s->istat0 |= LSI_ISTAT0_SIP;
403 } else {
404 s->istat0 &= ~LSI_ISTAT0_SIP;
405 }
406 if (s->istat0 & LSI_ISTAT0_INTF)
407 level = 1;
408
409 if (level != last_level) {
410 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
411 level, s->dstat, s->sist1, s->sist0);
412 last_level = level;
413 }
414 qemu_set_irq(s->dev.irq[0], level);
415 }
416
417 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
418 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
419 {
420 uint32_t mask0;
421 uint32_t mask1;
422
423 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
424 stat1, stat0, s->sist1, s->sist0);
425 s->sist0 |= stat0;
426 s->sist1 |= stat1;
427 /* Stop processor on fatal or unmasked interrupt. As a special hack
428 we don't stop processing when raising STO. Instead continue
429 execution and stop at the next insn that accesses the SCSI bus. */
430 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
431 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
432 mask1 &= ~LSI_SIST1_STO;
433 if (s->sist0 & mask0 || s->sist1 & mask1) {
434 lsi_stop_script(s);
435 }
436 lsi_update_irq(s);
437 }
438
439 /* Stop SCRIPTS execution and raise a DMA interrupt. */
440 static void lsi_script_dma_interrupt(LSIState *s, int stat)
441 {
442 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
443 s->dstat |= stat;
444 lsi_update_irq(s);
445 lsi_stop_script(s);
446 }
447
448 static inline void lsi_set_phase(LSIState *s, int phase)
449 {
450 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
451 }
452
453 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
454 {
455 /* Trigger a phase mismatch. */
456 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
457 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
458 s->dsp = s->pmjad1;
459 } else {
460 s->dsp = s->pmjad2;
461 }
462 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
463 } else {
464 DPRINTF("Phase mismatch interrupt\n");
465 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
466 lsi_stop_script(s);
467 }
468 lsi_set_phase(s, new_phase);
469 }
470
471
472 /* Resume SCRIPTS execution after a DMA operation. */
473 static void lsi_resume_script(LSIState *s)
474 {
475 if (s->waiting != 2) {
476 s->waiting = 0;
477 lsi_execute_script(s);
478 } else {
479 s->waiting = 0;
480 }
481 }
482
483 /* Initiate a SCSI layer data transfer. */
484 static void lsi_do_dma(LSIState *s, int out)
485 {
486 uint32_t count;
487 target_phys_addr_t addr;
488
489 if (!s->current_dma_len) {
490 /* Wait until data is available. */
491 DPRINTF("DMA no data available\n");
492 return;
493 }
494
495 count = s->dbc;
496 if (count > s->current_dma_len)
497 count = s->current_dma_len;
498
499 addr = s->dnad;
500 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
501 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
502 addr |= ((uint64_t)s->dnad64 << 32);
503 else if (s->dbms)
504 addr |= ((uint64_t)s->dbms << 32);
505 else if (s->sbms)
506 addr |= ((uint64_t)s->sbms << 32);
507
508 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
509 s->csbc += count;
510 s->dnad += count;
511 s->dbc -= count;
512
513 if (s->dma_buf == NULL) {
514 s->dma_buf = s->current_dev->info->get_buf(s->current_dev,
515 s->current_tag);
516 }
517
518 /* ??? Set SFBR to first data byte. */
519 if (out) {
520 cpu_physical_memory_read(addr, s->dma_buf, count);
521 } else {
522 cpu_physical_memory_write(addr, s->dma_buf, count);
523 }
524 s->current_dma_len -= count;
525 if (s->current_dma_len == 0) {
526 s->dma_buf = NULL;
527 if (out) {
528 /* Write the data. */
529 s->current_dev->info->write_data(s->current_dev, s->current_tag);
530 } else {
531 /* Request any remaining data. */
532 s->current_dev->info->read_data(s->current_dev, s->current_tag);
533 }
534 } else {
535 s->dma_buf += count;
536 lsi_resume_script(s);
537 }
538 }
539
540
541 /* Add a command to the queue. */
542 static void lsi_queue_command(LSIState *s)
543 {
544 lsi_queue *p;
545
546 DPRINTF("Queueing tag=0x%x\n", s->current_tag);
547 if (s->queue_len == s->active_commands) {
548 s->queue_len++;
549 s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
550 }
551 p = &s->queue[s->active_commands++];
552 p->tag = s->current_tag;
553 p->pending = 0;
554 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
555 }
556
557 /* Queue a byte for a MSG IN phase. */
558 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
559 {
560 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
561 BADF("MSG IN data too long\n");
562 } else {
563 DPRINTF("MSG IN 0x%02x\n", data);
564 s->msg[s->msg_len++] = data;
565 }
566 }
567
568 /* Perform reselection to continue a command. */
569 static void lsi_reselect(LSIState *s, uint32_t tag)
570 {
571 lsi_queue *p;
572 int n;
573 int id;
574
575 p = NULL;
576 for (n = 0; n < s->active_commands; n++) {
577 p = &s->queue[n];
578 if (p->tag == tag)
579 break;
580 }
581 if (n == s->active_commands) {
582 BADF("Reselected non-existant command tag=0x%x\n", tag);
583 return;
584 }
585 id = (tag >> 8) & 0xf;
586 s->ssid = id | 0x80;
587 DPRINTF("Reselected target %d\n", id);
588 s->current_dev = s->bus.devs[id];
589 s->current_tag = tag;
590 s->scntl1 |= LSI_SCNTL1_CON;
591 lsi_set_phase(s, PHASE_MI);
592 s->msg_action = p->out ? 2 : 3;
593 s->current_dma_len = p->pending;
594 s->dma_buf = NULL;
595 lsi_add_msg_byte(s, 0x80);
596 if (s->current_tag & LSI_TAG_VALID) {
597 lsi_add_msg_byte(s, 0x20);
598 lsi_add_msg_byte(s, tag & 0xff);
599 }
600
601 s->active_commands--;
602 if (n != s->active_commands) {
603 s->queue[n] = s->queue[s->active_commands];
604 }
605 }
606
607 /* Record that data is available for a queued command. Returns zero if
608 the device was reselected, nonzero if the IO is deferred. */
609 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
610 {
611 lsi_queue *p;
612 int i;
613 for (i = 0; i < s->active_commands; i++) {
614 p = &s->queue[i];
615 if (p->tag == tag) {
616 if (p->pending) {
617 BADF("Multiple IO pending for tag %d\n", tag);
618 }
619 p->pending = arg;
620 if (s->waiting == 1) {
621 /* Reselect device. */
622 lsi_reselect(s, tag);
623 return 0;
624 } else {
625 DPRINTF("Queueing IO tag=0x%x\n", tag);
626 p->pending = arg;
627 return 1;
628 }
629 }
630 }
631 BADF("IO with unknown tag %d\n", tag);
632 return 1;
633 }
634
635 /* Callback to indicate that the SCSI layer has completed a transfer. */
636 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
637 uint32_t arg)
638 {
639 LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
640 int out;
641
642 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
643 if (reason == SCSI_REASON_DONE) {
644 DPRINTF("Command complete sense=%d\n", (int)arg);
645 s->sense = arg;
646 s->command_complete = 2;
647 if (s->waiting && s->dbc != 0) {
648 /* Raise phase mismatch for short transfers. */
649 lsi_bad_phase(s, out, PHASE_ST);
650 } else {
651 lsi_set_phase(s, PHASE_ST);
652 }
653 lsi_resume_script(s);
654 return;
655 }
656
657 if (s->waiting == 1 || tag != s->current_tag) {
658 if (lsi_queue_tag(s, tag, arg))
659 return;
660 }
661 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
662 s->current_dma_len = arg;
663 s->command_complete = 1;
664 if (!s->waiting)
665 return;
666 if (s->waiting == 1 || s->dbc == 0) {
667 lsi_resume_script(s);
668 } else {
669 lsi_do_dma(s, out);
670 }
671 }
672
673 static void lsi_do_command(LSIState *s)
674 {
675 uint8_t buf[16];
676 int n;
677
678 DPRINTF("Send command len=%d\n", s->dbc);
679 if (s->dbc > 16)
680 s->dbc = 16;
681 cpu_physical_memory_read(s->dnad, buf, s->dbc);
682 s->sfbr = buf[0];
683 s->command_complete = 0;
684 n = s->current_dev->info->send_command(s->current_dev, s->current_tag, buf,
685 s->current_lun);
686 if (n > 0) {
687 lsi_set_phase(s, PHASE_DI);
688 s->current_dev->info->read_data(s->current_dev, s->current_tag);
689 } else if (n < 0) {
690 lsi_set_phase(s, PHASE_DO);
691 s->current_dev->info->write_data(s->current_dev, s->current_tag);
692 }
693
694 if (!s->command_complete) {
695 if (n) {
696 /* Command did not complete immediately so disconnect. */
697 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
698 lsi_add_msg_byte(s, 4); /* DISCONNECT */
699 /* wait data */
700 lsi_set_phase(s, PHASE_MI);
701 s->msg_action = 1;
702 lsi_queue_command(s);
703 } else {
704 /* wait command complete */
705 lsi_set_phase(s, PHASE_DI);
706 }
707 }
708 }
709
710 static void lsi_do_status(LSIState *s)
711 {
712 uint8_t sense;
713 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
714 if (s->dbc != 1)
715 BADF("Bad Status move\n");
716 s->dbc = 1;
717 sense = s->sense;
718 s->sfbr = sense;
719 cpu_physical_memory_write(s->dnad, &sense, 1);
720 lsi_set_phase(s, PHASE_MI);
721 s->msg_action = 1;
722 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
723 }
724
725 static void lsi_disconnect(LSIState *s)
726 {
727 s->scntl1 &= ~LSI_SCNTL1_CON;
728 s->sstat1 &= ~PHASE_MASK;
729 }
730
731 static void lsi_do_msgin(LSIState *s)
732 {
733 int len;
734 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
735 s->sfbr = s->msg[0];
736 len = s->msg_len;
737 if (len > s->dbc)
738 len = s->dbc;
739 cpu_physical_memory_write(s->dnad, s->msg, len);
740 /* Linux drivers rely on the last byte being in the SIDL. */
741 s->sidl = s->msg[len - 1];
742 s->msg_len -= len;
743 if (s->msg_len) {
744 memmove(s->msg, s->msg + len, s->msg_len);
745 } else {
746 /* ??? Check if ATN (not yet implemented) is asserted and maybe
747 switch to PHASE_MO. */
748 switch (s->msg_action) {
749 case 0:
750 lsi_set_phase(s, PHASE_CMD);
751 break;
752 case 1:
753 lsi_disconnect(s);
754 break;
755 case 2:
756 lsi_set_phase(s, PHASE_DO);
757 break;
758 case 3:
759 lsi_set_phase(s, PHASE_DI);
760 break;
761 default:
762 abort();
763 }
764 }
765 }
766
767 /* Read the next byte during a MSGOUT phase. */
768 static uint8_t lsi_get_msgbyte(LSIState *s)
769 {
770 uint8_t data;
771 cpu_physical_memory_read(s->dnad, &data, 1);
772 s->dnad++;
773 s->dbc--;
774 return data;
775 }
776
777 static void lsi_do_msgout(LSIState *s)
778 {
779 uint8_t msg;
780 int len;
781
782 DPRINTF("MSG out len=%d\n", s->dbc);
783 while (s->dbc) {
784 msg = lsi_get_msgbyte(s);
785 s->sfbr = msg;
786
787 switch (msg) {
788 case 0x00:
789 DPRINTF("MSG: Disconnect\n");
790 lsi_disconnect(s);
791 break;
792 case 0x08:
793 DPRINTF("MSG: No Operation\n");
794 lsi_set_phase(s, PHASE_CMD);
795 break;
796 case 0x01:
797 len = lsi_get_msgbyte(s);
798 msg = lsi_get_msgbyte(s);
799 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
800 switch (msg) {
801 case 1:
802 DPRINTF("SDTR (ignored)\n");
803 s->dbc -= 2;
804 break;
805 case 3:
806 DPRINTF("WDTR (ignored)\n");
807 s->dbc -= 1;
808 break;
809 default:
810 goto bad;
811 }
812 break;
813 case 0x20: /* SIMPLE queue */
814 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
815 DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
816 break;
817 case 0x21: /* HEAD of queue */
818 BADF("HEAD queue not implemented\n");
819 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
820 break;
821 case 0x22: /* ORDERED queue */
822 BADF("ORDERED queue not implemented\n");
823 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
824 break;
825 default:
826 if ((msg & 0x80) == 0) {
827 goto bad;
828 }
829 s->current_lun = msg & 7;
830 DPRINTF("Select LUN %d\n", s->current_lun);
831 lsi_set_phase(s, PHASE_CMD);
832 break;
833 }
834 }
835 return;
836 bad:
837 BADF("Unimplemented message 0x%02x\n", msg);
838 lsi_set_phase(s, PHASE_MI);
839 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
840 s->msg_action = 0;
841 }
842
843 /* Sign extend a 24-bit value. */
844 static inline int32_t sxt24(int32_t n)
845 {
846 return (n << 8) >> 8;
847 }
848
849 #define LSI_BUF_SIZE 4096
850 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
851 {
852 int n;
853 uint8_t buf[LSI_BUF_SIZE];
854
855 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
856 while (count) {
857 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
858 cpu_physical_memory_read(src, buf, n);
859 cpu_physical_memory_write(dest, buf, n);
860 src += n;
861 dest += n;
862 count -= n;
863 }
864 }
865
866 static void lsi_wait_reselect(LSIState *s)
867 {
868 int i;
869 DPRINTF("Wait Reselect\n");
870 if (s->current_dma_len)
871 BADF("Reselect with pending DMA\n");
872 for (i = 0; i < s->active_commands; i++) {
873 if (s->queue[i].pending) {
874 lsi_reselect(s, s->queue[i].tag);
875 break;
876 }
877 }
878 if (s->current_dma_len == 0) {
879 s->waiting = 1;
880 }
881 }
882
883 static void lsi_execute_script(LSIState *s)
884 {
885 uint32_t insn;
886 uint32_t addr, addr_high;
887 int opcode;
888 int insn_processed = 0;
889
890 s->istat1 |= LSI_ISTAT1_SRUN;
891 again:
892 insn_processed++;
893 insn = read_dword(s, s->dsp);
894 if (!insn) {
895 /* If we receive an empty opcode increment the DSP by 4 bytes
896 instead of 8 and execute the next opcode at that location */
897 s->dsp += 4;
898 goto again;
899 }
900 addr = read_dword(s, s->dsp + 4);
901 addr_high = 0;
902 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
903 s->dsps = addr;
904 s->dcmd = insn >> 24;
905 s->dsp += 8;
906 switch (insn >> 30) {
907 case 0: /* Block move. */
908 if (s->sist1 & LSI_SIST1_STO) {
909 DPRINTF("Delayed select timeout\n");
910 lsi_stop_script(s);
911 break;
912 }
913 s->dbc = insn & 0xffffff;
914 s->rbc = s->dbc;
915 /* ??? Set ESA. */
916 s->ia = s->dsp - 8;
917 if (insn & (1 << 29)) {
918 /* Indirect addressing. */
919 addr = read_dword(s, addr);
920 } else if (insn & (1 << 28)) {
921 uint32_t buf[2];
922 int32_t offset;
923 /* Table indirect addressing. */
924
925 /* 32-bit Table indirect */
926 offset = sxt24(addr);
927 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
928 /* byte count is stored in bits 0:23 only */
929 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
930 s->rbc = s->dbc;
931 addr = cpu_to_le32(buf[1]);
932
933 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
934 * table, bits [31:24] */
935 if (lsi_dma_40bit(s))
936 addr_high = cpu_to_le32(buf[0]) >> 24;
937 else if (lsi_dma_ti64bit(s)) {
938 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
939 switch (selector) {
940 case 0 ... 0x0f:
941 /* offset index into scratch registers since
942 * TI64 mode can use registers C to R */
943 addr_high = s->scratch[2 + selector];
944 break;
945 case 0x10:
946 addr_high = s->mmrs;
947 break;
948 case 0x11:
949 addr_high = s->mmws;
950 break;
951 case 0x12:
952 addr_high = s->sfs;
953 break;
954 case 0x13:
955 addr_high = s->drs;
956 break;
957 case 0x14:
958 addr_high = s->sbms;
959 break;
960 case 0x15:
961 addr_high = s->dbms;
962 break;
963 default:
964 BADF("Illegal selector specified (0x%x > 0x15)"
965 " for 64-bit DMA block move", selector);
966 break;
967 }
968 }
969 } else if (lsi_dma_64bit(s)) {
970 /* fetch a 3rd dword if 64-bit direct move is enabled and
971 only if we're not doing table indirect or indirect addressing */
972 s->dbms = read_dword(s, s->dsp);
973 s->dsp += 4;
974 s->ia = s->dsp - 12;
975 }
976 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
977 DPRINTF("Wrong phase got %d expected %d\n",
978 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
979 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
980 break;
981 }
982 s->dnad = addr;
983 s->dnad64 = addr_high;
984 switch (s->sstat1 & 0x7) {
985 case PHASE_DO:
986 s->waiting = 2;
987 lsi_do_dma(s, 1);
988 if (s->waiting)
989 s->waiting = 3;
990 break;
991 case PHASE_DI:
992 s->waiting = 2;
993 lsi_do_dma(s, 0);
994 if (s->waiting)
995 s->waiting = 3;
996 break;
997 case PHASE_CMD:
998 lsi_do_command(s);
999 break;
1000 case PHASE_ST:
1001 lsi_do_status(s);
1002 break;
1003 case PHASE_MO:
1004 lsi_do_msgout(s);
1005 break;
1006 case PHASE_MI:
1007 lsi_do_msgin(s);
1008 break;
1009 default:
1010 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1011 exit(1);
1012 }
1013 s->dfifo = s->dbc & 0xff;
1014 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1015 s->sbc = s->dbc;
1016 s->rbc -= s->dbc;
1017 s->ua = addr + s->dbc;
1018 break;
1019
1020 case 1: /* IO or Read/Write instruction. */
1021 opcode = (insn >> 27) & 7;
1022 if (opcode < 5) {
1023 uint32_t id;
1024
1025 if (insn & (1 << 25)) {
1026 id = read_dword(s, s->dsa + sxt24(insn));
1027 } else {
1028 id = addr;
1029 }
1030 id = (id >> 16) & 0xf;
1031 if (insn & (1 << 26)) {
1032 addr = s->dsp + sxt24(addr);
1033 }
1034 s->dnad = addr;
1035 switch (opcode) {
1036 case 0: /* Select */
1037 s->sdid = id;
1038 if (s->current_dma_len && (s->ssid & 0xf) == id) {
1039 DPRINTF("Already reselected by target %d\n", id);
1040 break;
1041 }
1042 s->sstat0 |= LSI_SSTAT0_WOA;
1043 s->scntl1 &= ~LSI_SCNTL1_IARB;
1044 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1045 DPRINTF("Selected absent target %d\n", id);
1046 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1047 lsi_disconnect(s);
1048 break;
1049 }
1050 DPRINTF("Selected target %d%s\n",
1051 id, insn & (1 << 3) ? " ATN" : "");
1052 /* ??? Linux drivers compain when this is set. Maybe
1053 it only applies in low-level mode (unimplemented).
1054 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1055 s->current_dev = s->bus.devs[id];
1056 s->current_tag = id << 8;
1057 s->scntl1 |= LSI_SCNTL1_CON;
1058 if (insn & (1 << 3)) {
1059 s->socl |= LSI_SOCL_ATN;
1060 }
1061 lsi_set_phase(s, PHASE_MO);
1062 break;
1063 case 1: /* Disconnect */
1064 DPRINTF("Wait Disconect\n");
1065 s->scntl1 &= ~LSI_SCNTL1_CON;
1066 break;
1067 case 2: /* Wait Reselect */
1068 lsi_wait_reselect(s);
1069 break;
1070 case 3: /* Set */
1071 DPRINTF("Set%s%s%s%s\n",
1072 insn & (1 << 3) ? " ATN" : "",
1073 insn & (1 << 6) ? " ACK" : "",
1074 insn & (1 << 9) ? " TM" : "",
1075 insn & (1 << 10) ? " CC" : "");
1076 if (insn & (1 << 3)) {
1077 s->socl |= LSI_SOCL_ATN;
1078 lsi_set_phase(s, PHASE_MO);
1079 }
1080 if (insn & (1 << 9)) {
1081 BADF("Target mode not implemented\n");
1082 exit(1);
1083 }
1084 if (insn & (1 << 10))
1085 s->carry = 1;
1086 break;
1087 case 4: /* Clear */
1088 DPRINTF("Clear%s%s%s%s\n",
1089 insn & (1 << 3) ? " ATN" : "",
1090 insn & (1 << 6) ? " ACK" : "",
1091 insn & (1 << 9) ? " TM" : "",
1092 insn & (1 << 10) ? " CC" : "");
1093 if (insn & (1 << 3)) {
1094 s->socl &= ~LSI_SOCL_ATN;
1095 }
1096 if (insn & (1 << 10))
1097 s->carry = 0;
1098 break;
1099 }
1100 } else {
1101 uint8_t op0;
1102 uint8_t op1;
1103 uint8_t data8;
1104 int reg;
1105 int operator;
1106 #ifdef DEBUG_LSI
1107 static const char *opcode_names[3] =
1108 {"Write", "Read", "Read-Modify-Write"};
1109 static const char *operator_names[8] =
1110 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1111 #endif
1112
1113 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1114 data8 = (insn >> 8) & 0xff;
1115 opcode = (insn >> 27) & 7;
1116 operator = (insn >> 24) & 7;
1117 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1118 opcode_names[opcode - 5], reg,
1119 operator_names[operator], data8, s->sfbr,
1120 (insn & (1 << 23)) ? " SFBR" : "");
1121 op0 = op1 = 0;
1122 switch (opcode) {
1123 case 5: /* From SFBR */
1124 op0 = s->sfbr;
1125 op1 = data8;
1126 break;
1127 case 6: /* To SFBR */
1128 if (operator)
1129 op0 = lsi_reg_readb(s, reg);
1130 op1 = data8;
1131 break;
1132 case 7: /* Read-modify-write */
1133 if (operator)
1134 op0 = lsi_reg_readb(s, reg);
1135 if (insn & (1 << 23)) {
1136 op1 = s->sfbr;
1137 } else {
1138 op1 = data8;
1139 }
1140 break;
1141 }
1142
1143 switch (operator) {
1144 case 0: /* move */
1145 op0 = op1;
1146 break;
1147 case 1: /* Shift left */
1148 op1 = op0 >> 7;
1149 op0 = (op0 << 1) | s->carry;
1150 s->carry = op1;
1151 break;
1152 case 2: /* OR */
1153 op0 |= op1;
1154 break;
1155 case 3: /* XOR */
1156 op0 ^= op1;
1157 break;
1158 case 4: /* AND */
1159 op0 &= op1;
1160 break;
1161 case 5: /* SHR */
1162 op1 = op0 & 1;
1163 op0 = (op0 >> 1) | (s->carry << 7);
1164 s->carry = op1;
1165 break;
1166 case 6: /* ADD */
1167 op0 += op1;
1168 s->carry = op0 < op1;
1169 break;
1170 case 7: /* ADC */
1171 op0 += op1 + s->carry;
1172 if (s->carry)
1173 s->carry = op0 <= op1;
1174 else
1175 s->carry = op0 < op1;
1176 break;
1177 }
1178
1179 switch (opcode) {
1180 case 5: /* From SFBR */
1181 case 7: /* Read-modify-write */
1182 lsi_reg_writeb(s, reg, op0);
1183 break;
1184 case 6: /* To SFBR */
1185 s->sfbr = op0;
1186 break;
1187 }
1188 }
1189 break;
1190
1191 case 2: /* Transfer Control. */
1192 {
1193 int cond;
1194 int jmp;
1195
1196 if ((insn & 0x002e0000) == 0) {
1197 DPRINTF("NOP\n");
1198 break;
1199 }
1200 if (s->sist1 & LSI_SIST1_STO) {
1201 DPRINTF("Delayed select timeout\n");
1202 lsi_stop_script(s);
1203 break;
1204 }
1205 cond = jmp = (insn & (1 << 19)) != 0;
1206 if (cond == jmp && (insn & (1 << 21))) {
1207 DPRINTF("Compare carry %d\n", s->carry == jmp);
1208 cond = s->carry != 0;
1209 }
1210 if (cond == jmp && (insn & (1 << 17))) {
1211 DPRINTF("Compare phase %d %c= %d\n",
1212 (s->sstat1 & PHASE_MASK),
1213 jmp ? '=' : '!',
1214 ((insn >> 24) & 7));
1215 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1216 }
1217 if (cond == jmp && (insn & (1 << 18))) {
1218 uint8_t mask;
1219
1220 mask = (~insn >> 8) & 0xff;
1221 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1222 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1223 cond = (s->sfbr & mask) == (insn & mask);
1224 }
1225 if (cond == jmp) {
1226 if (insn & (1 << 23)) {
1227 /* Relative address. */
1228 addr = s->dsp + sxt24(addr);
1229 }
1230 switch ((insn >> 27) & 7) {
1231 case 0: /* Jump */
1232 DPRINTF("Jump to 0x%08x\n", addr);
1233 s->dsp = addr;
1234 break;
1235 case 1: /* Call */
1236 DPRINTF("Call 0x%08x\n", addr);
1237 s->temp = s->dsp;
1238 s->dsp = addr;
1239 break;
1240 case 2: /* Return */
1241 DPRINTF("Return to 0x%08x\n", s->temp);
1242 s->dsp = s->temp;
1243 break;
1244 case 3: /* Interrupt */
1245 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1246 if ((insn & (1 << 20)) != 0) {
1247 s->istat0 |= LSI_ISTAT0_INTF;
1248 lsi_update_irq(s);
1249 } else {
1250 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1251 }
1252 break;
1253 default:
1254 DPRINTF("Illegal transfer control\n");
1255 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1256 break;
1257 }
1258 } else {
1259 DPRINTF("Control condition failed\n");
1260 }
1261 }
1262 break;
1263
1264 case 3:
1265 if ((insn & (1 << 29)) == 0) {
1266 /* Memory move. */
1267 uint32_t dest;
1268 /* ??? The docs imply the destination address is loaded into
1269 the TEMP register. However the Linux drivers rely on
1270 the value being presrved. */
1271 dest = read_dword(s, s->dsp);
1272 s->dsp += 4;
1273 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1274 } else {
1275 uint8_t data[7];
1276 int reg;
1277 int n;
1278 int i;
1279
1280 if (insn & (1 << 28)) {
1281 addr = s->dsa + sxt24(addr);
1282 }
1283 n = (insn & 7);
1284 reg = (insn >> 16) & 0xff;
1285 if (insn & (1 << 24)) {
1286 cpu_physical_memory_read(addr, data, n);
1287 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1288 addr, *(int *)data);
1289 for (i = 0; i < n; i++) {
1290 lsi_reg_writeb(s, reg + i, data[i]);
1291 }
1292 } else {
1293 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1294 for (i = 0; i < n; i++) {
1295 data[i] = lsi_reg_readb(s, reg + i);
1296 }
1297 cpu_physical_memory_write(addr, data, n);
1298 }
1299 }
1300 }
1301 if (insn_processed > 10000 && !s->waiting) {
1302 /* Some windows drivers make the device spin waiting for a memory
1303 location to change. If we have been executed a lot of code then
1304 assume this is the case and force an unexpected device disconnect.
1305 This is apparently sufficient to beat the drivers into submission.
1306 */
1307 if (!(s->sien0 & LSI_SIST0_UDC))
1308 fprintf(stderr, "inf. loop with UDC masked\n");
1309 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1310 lsi_disconnect(s);
1311 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1312 if (s->dcntl & LSI_DCNTL_SSM) {
1313 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1314 } else {
1315 goto again;
1316 }
1317 }
1318 DPRINTF("SCRIPTS execution stopped\n");
1319 }
1320
1321 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1322 {
1323 uint8_t tmp;
1324 #define CASE_GET_REG24(name, addr) \
1325 case addr: return s->name & 0xff; \
1326 case addr + 1: return (s->name >> 8) & 0xff; \
1327 case addr + 2: return (s->name >> 16) & 0xff;
1328
1329 #define CASE_GET_REG32(name, addr) \
1330 case addr: return s->name & 0xff; \
1331 case addr + 1: return (s->name >> 8) & 0xff; \
1332 case addr + 2: return (s->name >> 16) & 0xff; \
1333 case addr + 3: return (s->name >> 24) & 0xff;
1334
1335 #ifdef DEBUG_LSI_REG
1336 DPRINTF("Read reg %x\n", offset);
1337 #endif
1338 switch (offset) {
1339 case 0x00: /* SCNTL0 */
1340 return s->scntl0;
1341 case 0x01: /* SCNTL1 */
1342 return s->scntl1;
1343 case 0x02: /* SCNTL2 */
1344 return s->scntl2;
1345 case 0x03: /* SCNTL3 */
1346 return s->scntl3;
1347 case 0x04: /* SCID */
1348 return s->scid;
1349 case 0x05: /* SXFER */
1350 return s->sxfer;
1351 case 0x06: /* SDID */
1352 return s->sdid;
1353 case 0x07: /* GPREG0 */
1354 return 0x7f;
1355 case 0x08: /* Revision ID */
1356 return 0x00;
1357 case 0xa: /* SSID */
1358 return s->ssid;
1359 case 0xb: /* SBCL */
1360 /* ??? This is not correct. However it's (hopefully) only
1361 used for diagnostics, so should be ok. */
1362 return 0;
1363 case 0xc: /* DSTAT */
1364 tmp = s->dstat | 0x80;
1365 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1366 s->dstat = 0;
1367 lsi_update_irq(s);
1368 return tmp;
1369 case 0x0d: /* SSTAT0 */
1370 return s->sstat0;
1371 case 0x0e: /* SSTAT1 */
1372 return s->sstat1;
1373 case 0x0f: /* SSTAT2 */
1374 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1375 CASE_GET_REG32(dsa, 0x10)
1376 case 0x14: /* ISTAT0 */
1377 return s->istat0;
1378 case 0x15: /* ISTAT1 */
1379 return s->istat1;
1380 case 0x16: /* MBOX0 */
1381 return s->mbox0;
1382 case 0x17: /* MBOX1 */
1383 return s->mbox1;
1384 case 0x18: /* CTEST0 */
1385 return 0xff;
1386 case 0x19: /* CTEST1 */
1387 return 0;
1388 case 0x1a: /* CTEST2 */
1389 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1390 if (s->istat0 & LSI_ISTAT0_SIGP) {
1391 s->istat0 &= ~LSI_ISTAT0_SIGP;
1392 tmp |= LSI_CTEST2_SIGP;
1393 }
1394 return tmp;
1395 case 0x1b: /* CTEST3 */
1396 return s->ctest3;
1397 CASE_GET_REG32(temp, 0x1c)
1398 case 0x20: /* DFIFO */
1399 return 0;
1400 case 0x21: /* CTEST4 */
1401 return s->ctest4;
1402 case 0x22: /* CTEST5 */
1403 return s->ctest5;
1404 case 0x23: /* CTEST6 */
1405 return 0;
1406 CASE_GET_REG24(dbc, 0x24)
1407 case 0x27: /* DCMD */
1408 return s->dcmd;
1409 CASE_GET_REG32(dnad, 0x28)
1410 CASE_GET_REG32(dsp, 0x2c)
1411 CASE_GET_REG32(dsps, 0x30)
1412 CASE_GET_REG32(scratch[0], 0x34)
1413 case 0x38: /* DMODE */
1414 return s->dmode;
1415 case 0x39: /* DIEN */
1416 return s->dien;
1417 case 0x3a: /* SBR */
1418 return s->sbr;
1419 case 0x3b: /* DCNTL */
1420 return s->dcntl;
1421 case 0x40: /* SIEN0 */
1422 return s->sien0;
1423 case 0x41: /* SIEN1 */
1424 return s->sien1;
1425 case 0x42: /* SIST0 */
1426 tmp = s->sist0;
1427 s->sist0 = 0;
1428 lsi_update_irq(s);
1429 return tmp;
1430 case 0x43: /* SIST1 */
1431 tmp = s->sist1;
1432 s->sist1 = 0;
1433 lsi_update_irq(s);
1434 return tmp;
1435 case 0x46: /* MACNTL */
1436 return 0x0f;
1437 case 0x47: /* GPCNTL0 */
1438 return 0x0f;
1439 case 0x48: /* STIME0 */
1440 return s->stime0;
1441 case 0x4a: /* RESPID0 */
1442 return s->respid0;
1443 case 0x4b: /* RESPID1 */
1444 return s->respid1;
1445 case 0x4d: /* STEST1 */
1446 return s->stest1;
1447 case 0x4e: /* STEST2 */
1448 return s->stest2;
1449 case 0x4f: /* STEST3 */
1450 return s->stest3;
1451 case 0x50: /* SIDL */
1452 /* This is needed by the linux drivers. We currently only update it
1453 during the MSG IN phase. */
1454 return s->sidl;
1455 case 0x52: /* STEST4 */
1456 return 0xe0;
1457 case 0x56: /* CCNTL0 */
1458 return s->ccntl0;
1459 case 0x57: /* CCNTL1 */
1460 return s->ccntl1;
1461 case 0x58: /* SBDL */
1462 /* Some drivers peek at the data bus during the MSG IN phase. */
1463 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1464 return s->msg[0];
1465 return 0;
1466 case 0x59: /* SBDL high */
1467 return 0;
1468 CASE_GET_REG32(mmrs, 0xa0)
1469 CASE_GET_REG32(mmws, 0xa4)
1470 CASE_GET_REG32(sfs, 0xa8)
1471 CASE_GET_REG32(drs, 0xac)
1472 CASE_GET_REG32(sbms, 0xb0)
1473 CASE_GET_REG32(dbms, 0xb4)
1474 CASE_GET_REG32(dnad64, 0xb8)
1475 CASE_GET_REG32(pmjad1, 0xc0)
1476 CASE_GET_REG32(pmjad2, 0xc4)
1477 CASE_GET_REG32(rbc, 0xc8)
1478 CASE_GET_REG32(ua, 0xcc)
1479 CASE_GET_REG32(ia, 0xd4)
1480 CASE_GET_REG32(sbc, 0xd8)
1481 CASE_GET_REG32(csbc, 0xdc)
1482 }
1483 if (offset >= 0x5c && offset < 0xa0) {
1484 int n;
1485 int shift;
1486 n = (offset - 0x58) >> 2;
1487 shift = (offset & 3) * 8;
1488 return (s->scratch[n] >> shift) & 0xff;
1489 }
1490 BADF("readb 0x%x\n", offset);
1491 exit(1);
1492 #undef CASE_GET_REG24
1493 #undef CASE_GET_REG32
1494 }
1495
1496 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1497 {
1498 #define CASE_SET_REG24(name, addr) \
1499 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1500 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1501 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1502
1503 #define CASE_SET_REG32(name, addr) \
1504 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1505 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1506 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1507 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1508
1509 #ifdef DEBUG_LSI_REG
1510 DPRINTF("Write reg %x = %02x\n", offset, val);
1511 #endif
1512 switch (offset) {
1513 case 0x00: /* SCNTL0 */
1514 s->scntl0 = val;
1515 if (val & LSI_SCNTL0_START) {
1516 BADF("Start sequence not implemented\n");
1517 }
1518 break;
1519 case 0x01: /* SCNTL1 */
1520 s->scntl1 = val & ~LSI_SCNTL1_SST;
1521 if (val & LSI_SCNTL1_IARB) {
1522 BADF("Immediate Arbritration not implemented\n");
1523 }
1524 if (val & LSI_SCNTL1_RST) {
1525 s->sstat0 |= LSI_SSTAT0_RST;
1526 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1527 } else {
1528 s->sstat0 &= ~LSI_SSTAT0_RST;
1529 }
1530 break;
1531 case 0x02: /* SCNTL2 */
1532 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1533 s->scntl2 = val;
1534 break;
1535 case 0x03: /* SCNTL3 */
1536 s->scntl3 = val;
1537 break;
1538 case 0x04: /* SCID */
1539 s->scid = val;
1540 break;
1541 case 0x05: /* SXFER */
1542 s->sxfer = val;
1543 break;
1544 case 0x06: /* SDID */
1545 if ((val & 0xf) != (s->ssid & 0xf))
1546 BADF("Destination ID does not match SSID\n");
1547 s->sdid = val & 0xf;
1548 break;
1549 case 0x07: /* GPREG0 */
1550 break;
1551 case 0x08: /* SFBR */
1552 /* The CPU is not allowed to write to this register. However the
1553 SCRIPTS register move instructions are. */
1554 s->sfbr = val;
1555 break;
1556 case 0x0a: case 0x0b:
1557 /* Openserver writes to these readonly registers on startup */
1558 return;
1559 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1560 /* Linux writes to these readonly registers on startup. */
1561 return;
1562 CASE_SET_REG32(dsa, 0x10)
1563 case 0x14: /* ISTAT0 */
1564 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1565 if (val & LSI_ISTAT0_ABRT) {
1566 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1567 }
1568 if (val & LSI_ISTAT0_INTF) {
1569 s->istat0 &= ~LSI_ISTAT0_INTF;
1570 lsi_update_irq(s);
1571 }
1572 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1573 DPRINTF("Woken by SIGP\n");
1574 s->waiting = 0;
1575 s->dsp = s->dnad;
1576 lsi_execute_script(s);
1577 }
1578 if (val & LSI_ISTAT0_SRST) {
1579 lsi_soft_reset(s);
1580 }
1581 break;
1582 case 0x16: /* MBOX0 */
1583 s->mbox0 = val;
1584 break;
1585 case 0x17: /* MBOX1 */
1586 s->mbox1 = val;
1587 break;
1588 case 0x1a: /* CTEST2 */
1589 s->ctest2 = val & LSI_CTEST2_PCICIE;
1590 break;
1591 case 0x1b: /* CTEST3 */
1592 s->ctest3 = val & 0x0f;
1593 break;
1594 CASE_SET_REG32(temp, 0x1c)
1595 case 0x21: /* CTEST4 */
1596 if (val & 7) {
1597 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1598 }
1599 s->ctest4 = val;
1600 break;
1601 case 0x22: /* CTEST5 */
1602 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1603 BADF("CTEST5 DMA increment not implemented\n");
1604 }
1605 s->ctest5 = val;
1606 break;
1607 CASE_SET_REG24(dbc, 0x24)
1608 CASE_SET_REG32(dnad, 0x28)
1609 case 0x2c: /* DSP[0:7] */
1610 s->dsp &= 0xffffff00;
1611 s->dsp |= val;
1612 break;
1613 case 0x2d: /* DSP[8:15] */
1614 s->dsp &= 0xffff00ff;
1615 s->dsp |= val << 8;
1616 break;
1617 case 0x2e: /* DSP[16:23] */
1618 s->dsp &= 0xff00ffff;
1619 s->dsp |= val << 16;
1620 break;
1621 case 0x2f: /* DSP[24:31] */
1622 s->dsp &= 0x00ffffff;
1623 s->dsp |= val << 24;
1624 if ((s->dmode & LSI_DMODE_MAN) == 0
1625 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1626 lsi_execute_script(s);
1627 break;
1628 CASE_SET_REG32(dsps, 0x30)
1629 CASE_SET_REG32(scratch[0], 0x34)
1630 case 0x38: /* DMODE */
1631 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1632 BADF("IO mappings not implemented\n");
1633 }
1634 s->dmode = val;
1635 break;
1636 case 0x39: /* DIEN */
1637 s->dien = val;
1638 lsi_update_irq(s);
1639 break;
1640 case 0x3a: /* SBR */
1641 s->sbr = val;
1642 break;
1643 case 0x3b: /* DCNTL */
1644 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1645 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1646 lsi_execute_script(s);
1647 break;
1648 case 0x40: /* SIEN0 */
1649 s->sien0 = val;
1650 lsi_update_irq(s);
1651 break;
1652 case 0x41: /* SIEN1 */
1653 s->sien1 = val;
1654 lsi_update_irq(s);
1655 break;
1656 case 0x47: /* GPCNTL0 */
1657 break;
1658 case 0x48: /* STIME0 */
1659 s->stime0 = val;
1660 break;
1661 case 0x49: /* STIME1 */
1662 if (val & 0xf) {
1663 DPRINTF("General purpose timer not implemented\n");
1664 /* ??? Raising the interrupt immediately seems to be sufficient
1665 to keep the FreeBSD driver happy. */
1666 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1667 }
1668 break;
1669 case 0x4a: /* RESPID0 */
1670 s->respid0 = val;
1671 break;
1672 case 0x4b: /* RESPID1 */
1673 s->respid1 = val;
1674 break;
1675 case 0x4d: /* STEST1 */
1676 s->stest1 = val;
1677 break;
1678 case 0x4e: /* STEST2 */
1679 if (val & 1) {
1680 BADF("Low level mode not implemented\n");
1681 }
1682 s->stest2 = val;
1683 break;
1684 case 0x4f: /* STEST3 */
1685 if (val & 0x41) {
1686 BADF("SCSI FIFO test mode not implemented\n");
1687 }
1688 s->stest3 = val;
1689 break;
1690 case 0x56: /* CCNTL0 */
1691 s->ccntl0 = val;
1692 break;
1693 case 0x57: /* CCNTL1 */
1694 s->ccntl1 = val;
1695 break;
1696 CASE_SET_REG32(mmrs, 0xa0)
1697 CASE_SET_REG32(mmws, 0xa4)
1698 CASE_SET_REG32(sfs, 0xa8)
1699 CASE_SET_REG32(drs, 0xac)
1700 CASE_SET_REG32(sbms, 0xb0)
1701 CASE_SET_REG32(dbms, 0xb4)
1702 CASE_SET_REG32(dnad64, 0xb8)
1703 CASE_SET_REG32(pmjad1, 0xc0)
1704 CASE_SET_REG32(pmjad2, 0xc4)
1705 CASE_SET_REG32(rbc, 0xc8)
1706 CASE_SET_REG32(ua, 0xcc)
1707 CASE_SET_REG32(ia, 0xd4)
1708 CASE_SET_REG32(sbc, 0xd8)
1709 CASE_SET_REG32(csbc, 0xdc)
1710 default:
1711 if (offset >= 0x5c && offset < 0xa0) {
1712 int n;
1713 int shift;
1714 n = (offset - 0x58) >> 2;
1715 shift = (offset & 3) * 8;
1716 s->scratch[n] &= ~(0xff << shift);
1717 s->scratch[n] |= (val & 0xff) << shift;
1718 } else {
1719 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1720 }
1721 }
1722 #undef CASE_SET_REG24
1723 #undef CASE_SET_REG32
1724 }
1725
1726 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1727 {
1728 LSIState *s = opaque;
1729
1730 lsi_reg_writeb(s, addr & 0xff, val);
1731 }
1732
1733 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1734 {
1735 LSIState *s = opaque;
1736
1737 addr &= 0xff;
1738 lsi_reg_writeb(s, addr, val & 0xff);
1739 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1740 }
1741
1742 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1743 {
1744 LSIState *s = opaque;
1745
1746 addr &= 0xff;
1747 lsi_reg_writeb(s, addr, val & 0xff);
1748 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1749 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1750 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1751 }
1752
1753 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1754 {
1755 LSIState *s = opaque;
1756
1757 return lsi_reg_readb(s, addr & 0xff);
1758 }
1759
1760 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1761 {
1762 LSIState *s = opaque;
1763 uint32_t val;
1764
1765 addr &= 0xff;
1766 val = lsi_reg_readb(s, addr);
1767 val |= lsi_reg_readb(s, addr + 1) << 8;
1768 return val;
1769 }
1770
1771 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1772 {
1773 LSIState *s = opaque;
1774 uint32_t val;
1775 addr &= 0xff;
1776 val = lsi_reg_readb(s, addr);
1777 val |= lsi_reg_readb(s, addr + 1) << 8;
1778 val |= lsi_reg_readb(s, addr + 2) << 16;
1779 val |= lsi_reg_readb(s, addr + 3) << 24;
1780 return val;
1781 }
1782
1783 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1784 lsi_mmio_readb,
1785 lsi_mmio_readw,
1786 lsi_mmio_readl,
1787 };
1788
1789 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1790 lsi_mmio_writeb,
1791 lsi_mmio_writew,
1792 lsi_mmio_writel,
1793 };
1794
1795 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1796 {
1797 LSIState *s = opaque;
1798 uint32_t newval;
1799 int shift;
1800
1801 addr &= 0x1fff;
1802 newval = s->script_ram[addr >> 2];
1803 shift = (addr & 3) * 8;
1804 newval &= ~(0xff << shift);
1805 newval |= val << shift;
1806 s->script_ram[addr >> 2] = newval;
1807 }
1808
1809 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1810 {
1811 LSIState *s = opaque;
1812 uint32_t newval;
1813
1814 addr &= 0x1fff;
1815 newval = s->script_ram[addr >> 2];
1816 if (addr & 2) {
1817 newval = (newval & 0xffff) | (val << 16);
1818 } else {
1819 newval = (newval & 0xffff0000) | val;
1820 }
1821 s->script_ram[addr >> 2] = newval;
1822 }
1823
1824
1825 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1826 {
1827 LSIState *s = opaque;
1828
1829 addr &= 0x1fff;
1830 s->script_ram[addr >> 2] = val;
1831 }
1832
1833 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1834 {
1835 LSIState *s = opaque;
1836 uint32_t val;
1837
1838 addr &= 0x1fff;
1839 val = s->script_ram[addr >> 2];
1840 val >>= (addr & 3) * 8;
1841 return val & 0xff;
1842 }
1843
1844 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1845 {
1846 LSIState *s = opaque;
1847 uint32_t val;
1848
1849 addr &= 0x1fff;
1850 val = s->script_ram[addr >> 2];
1851 if (addr & 2)
1852 val >>= 16;
1853 return le16_to_cpu(val);
1854 }
1855
1856 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1857 {
1858 LSIState *s = opaque;
1859
1860 addr &= 0x1fff;
1861 return le32_to_cpu(s->script_ram[addr >> 2]);
1862 }
1863
1864 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1865 lsi_ram_readb,
1866 lsi_ram_readw,
1867 lsi_ram_readl,
1868 };
1869
1870 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1871 lsi_ram_writeb,
1872 lsi_ram_writew,
1873 lsi_ram_writel,
1874 };
1875
1876 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1877 {
1878 LSIState *s = opaque;
1879 return lsi_reg_readb(s, addr & 0xff);
1880 }
1881
1882 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1883 {
1884 LSIState *s = opaque;
1885 uint32_t val;
1886 addr &= 0xff;
1887 val = lsi_reg_readb(s, addr);
1888 val |= lsi_reg_readb(s, addr + 1) << 8;
1889 return val;
1890 }
1891
1892 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1893 {
1894 LSIState *s = opaque;
1895 uint32_t val;
1896 addr &= 0xff;
1897 val = lsi_reg_readb(s, addr);
1898 val |= lsi_reg_readb(s, addr + 1) << 8;
1899 val |= lsi_reg_readb(s, addr + 2) << 16;
1900 val |= lsi_reg_readb(s, addr + 3) << 24;
1901 return val;
1902 }
1903
1904 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1905 {
1906 LSIState *s = opaque;
1907 lsi_reg_writeb(s, addr & 0xff, val);
1908 }
1909
1910 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1911 {
1912 LSIState *s = opaque;
1913 addr &= 0xff;
1914 lsi_reg_writeb(s, addr, val & 0xff);
1915 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1916 }
1917
1918 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1919 {
1920 LSIState *s = opaque;
1921 addr &= 0xff;
1922 lsi_reg_writeb(s, addr, val & 0xff);
1923 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1924 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1925 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1926 }
1927
1928 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1929 uint32_t addr, uint32_t size, int type)
1930 {
1931 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1932
1933 DPRINTF("Mapping IO at %08x\n", addr);
1934
1935 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1936 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1937 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1938 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1939 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1940 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1941 }
1942
1943 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1944 uint32_t addr, uint32_t size, int type)
1945 {
1946 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1947
1948 DPRINTF("Mapping ram at %08x\n", addr);
1949 s->script_ram_base = addr;
1950 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1951 }
1952
1953 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1954 uint32_t addr, uint32_t size, int type)
1955 {
1956 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1957
1958 DPRINTF("Mapping registers at %08x\n", addr);
1959 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1960 }
1961
1962 static void lsi_pre_save(void *opaque)
1963 {
1964 LSIState *s = opaque;
1965
1966 assert(s->dma_buf == NULL);
1967 assert(s->current_dma_len == 0);
1968 assert(s->active_commands == 0);
1969 }
1970
1971 static const VMStateDescription vmstate_lsi_scsi = {
1972 .name = "lsiscsi",
1973 .version_id = 0,
1974 .minimum_version_id = 0,
1975 .minimum_version_id_old = 0,
1976 .pre_save = lsi_pre_save,
1977 .fields = (VMStateField []) {
1978 VMSTATE_PCI_DEVICE(dev, LSIState),
1979
1980 VMSTATE_INT32(carry, LSIState),
1981 VMSTATE_INT32(sense, LSIState),
1982 VMSTATE_INT32(msg_action, LSIState),
1983 VMSTATE_INT32(msg_len, LSIState),
1984 VMSTATE_BUFFER(msg, LSIState),
1985 VMSTATE_INT32(waiting, LSIState),
1986
1987 VMSTATE_UINT32(dsa, LSIState),
1988 VMSTATE_UINT32(temp, LSIState),
1989 VMSTATE_UINT32(dnad, LSIState),
1990 VMSTATE_UINT32(dbc, LSIState),
1991 VMSTATE_UINT8(istat0, LSIState),
1992 VMSTATE_UINT8(istat1, LSIState),
1993 VMSTATE_UINT8(dcmd, LSIState),
1994 VMSTATE_UINT8(dstat, LSIState),
1995 VMSTATE_UINT8(dien, LSIState),
1996 VMSTATE_UINT8(sist0, LSIState),
1997 VMSTATE_UINT8(sist1, LSIState),
1998 VMSTATE_UINT8(sien0, LSIState),
1999 VMSTATE_UINT8(sien1, LSIState),
2000 VMSTATE_UINT8(mbox0, LSIState),
2001 VMSTATE_UINT8(mbox1, LSIState),
2002 VMSTATE_UINT8(dfifo, LSIState),
2003 VMSTATE_UINT8(ctest2, LSIState),
2004 VMSTATE_UINT8(ctest3, LSIState),
2005 VMSTATE_UINT8(ctest4, LSIState),
2006 VMSTATE_UINT8(ctest5, LSIState),
2007 VMSTATE_UINT8(ccntl0, LSIState),
2008 VMSTATE_UINT8(ccntl1, LSIState),
2009 VMSTATE_UINT32(dsp, LSIState),
2010 VMSTATE_UINT32(dsps, LSIState),
2011 VMSTATE_UINT8(dmode, LSIState),
2012 VMSTATE_UINT8(dcntl, LSIState),
2013 VMSTATE_UINT8(scntl0, LSIState),
2014 VMSTATE_UINT8(scntl1, LSIState),
2015 VMSTATE_UINT8(scntl2, LSIState),
2016 VMSTATE_UINT8(scntl3, LSIState),
2017 VMSTATE_UINT8(sstat0, LSIState),
2018 VMSTATE_UINT8(sstat1, LSIState),
2019 VMSTATE_UINT8(scid, LSIState),
2020 VMSTATE_UINT8(sxfer, LSIState),
2021 VMSTATE_UINT8(socl, LSIState),
2022 VMSTATE_UINT8(sdid, LSIState),
2023 VMSTATE_UINT8(ssid, LSIState),
2024 VMSTATE_UINT8(sfbr, LSIState),
2025 VMSTATE_UINT8(stest1, LSIState),
2026 VMSTATE_UINT8(stest2, LSIState),
2027 VMSTATE_UINT8(stest3, LSIState),
2028 VMSTATE_UINT8(sidl, LSIState),
2029 VMSTATE_UINT8(stime0, LSIState),
2030 VMSTATE_UINT8(respid0, LSIState),
2031 VMSTATE_UINT8(respid1, LSIState),
2032 VMSTATE_UINT32(mmrs, LSIState),
2033 VMSTATE_UINT32(mmws, LSIState),
2034 VMSTATE_UINT32(sfs, LSIState),
2035 VMSTATE_UINT32(drs, LSIState),
2036 VMSTATE_UINT32(sbms, LSIState),
2037 VMSTATE_UINT32(dbms, LSIState),
2038 VMSTATE_UINT32(dnad64, LSIState),
2039 VMSTATE_UINT32(pmjad1, LSIState),
2040 VMSTATE_UINT32(pmjad2, LSIState),
2041 VMSTATE_UINT32(rbc, LSIState),
2042 VMSTATE_UINT32(ua, LSIState),
2043 VMSTATE_UINT32(ia, LSIState),
2044 VMSTATE_UINT32(sbc, LSIState),
2045 VMSTATE_UINT32(csbc, LSIState),
2046 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2047 VMSTATE_UINT8(sbr, LSIState),
2048
2049 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2050 VMSTATE_END_OF_LIST()
2051 }
2052 };
2053
2054 static int lsi_scsi_uninit(PCIDevice *d)
2055 {
2056 LSIState *s = DO_UPCAST(LSIState, dev, d);
2057
2058 cpu_unregister_io_memory(s->mmio_io_addr);
2059 cpu_unregister_io_memory(s->ram_io_addr);
2060
2061 qemu_free(s->queue);
2062
2063 return 0;
2064 }
2065
2066 static int lsi_scsi_init(PCIDevice *dev)
2067 {
2068 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2069 uint8_t *pci_conf;
2070
2071 pci_conf = s->dev.config;
2072
2073 /* PCI Vendor ID (word) */
2074 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2075 /* PCI device ID (word) */
2076 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2077 /* PCI base class code */
2078 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2079 /* PCI subsystem ID */
2080 pci_conf[0x2e] = 0x00;
2081 pci_conf[0x2f] = 0x10;
2082 /* PCI latency timer = 255 */
2083 pci_conf[0x0d] = 0xff;
2084 /* Interrupt pin 1 */
2085 pci_conf[0x3d] = 0x01;
2086
2087 s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2088 lsi_mmio_writefn, s);
2089 s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2090 lsi_ram_writefn, s);
2091
2092 pci_register_bar((struct PCIDevice *)s, 0, 256,
2093 PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2094 pci_register_bar((struct PCIDevice *)s, 1, 0x400,
2095 PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
2096 pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
2097 PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
2098 s->queue = qemu_malloc(sizeof(lsi_queue));
2099 s->queue_len = 1;
2100 s->active_commands = 0;
2101
2102 lsi_soft_reset(s);
2103
2104 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2105 if (!dev->qdev.hotplugged) {
2106 scsi_bus_legacy_handle_cmdline(&s->bus);
2107 }
2108 vmstate_register(-1, &vmstate_lsi_scsi, s);
2109 return 0;
2110 }
2111
2112 static PCIDeviceInfo lsi_info = {
2113 .qdev.name = "lsi53c895a",
2114 .qdev.alias = "lsi",
2115 .qdev.size = sizeof(LSIState),
2116 .init = lsi_scsi_init,
2117 .exit = lsi_scsi_uninit,
2118 };
2119
2120 static void lsi53c895a_register_devices(void)
2121 {
2122 pci_qdev_register(&lsi_info);
2123 }
2124
2125 device_init(lsi53c895a_register_devices);
QEmu