?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
virtio: fix up VQ checks
[qemu.git] / hw / lsi53c895a.c
blob1aef62f9a60c0164f349834f4993855506a1e1a5
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licenced under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h>
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18 #include "block_int.h"
19
20 //#define DEBUG_LSI
21 //#define DEBUG_LSI_REG
22
23 #ifdef DEBUG_LSI
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
28 #else
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
32 #endif
33
34 #define LSI_MAX_DEVS 7
35
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
41
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
50
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
59
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
68
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
72
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
81
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
90
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
95
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
104
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
112
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
121
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
128
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
137
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
144
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
150
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
156
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
159
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
161
162 #define PHASE_DO 0
163 #define PHASE_DI 1
164 #define PHASE_CMD 2
165 #define PHASE_ST 3
166 #define PHASE_MO 6
167 #define PHASE_MI 7
168 #define PHASE_MASK 7
169
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
172
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
175
176 typedef struct lsi_request {
177 uint32_t tag;
178 uint32_t dma_len;
179 uint8_t *dma_buf;
180 uint32_t pending;
181 int out;
182 QTAILQ_ENTRY(lsi_request) next;
183 } lsi_request;
184
185 typedef struct {
186 PCIDevice dev;
187 int mmio_io_addr;
188 int ram_io_addr;
189 uint32_t script_ram_base;
190
191 int carry; /* ??? Should this be an a visible register somewhere? */
192 int sense;
193 /* Action to take at the end of a MSG IN phase.
194 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
195 int msg_action;
196 int msg_len;
197 uint8_t msg[LSI_MAX_MSGIN_LEN];
198 /* 0 if SCRIPTS are running or stopped.
199 * 1 if a Wait Reselect instruction has been issued.
200 * 2 if processing DMA from lsi_execute_script.
201 * 3 if a DMA operation is in progress. */
202 int waiting;
203 SCSIBus bus;
204 int current_lun;
205 /* The tag is a combination of the device ID and the SCSI tag. */
206 uint32_t select_tag;
207 int command_complete;
208 QTAILQ_HEAD(, lsi_request) queue;
209 lsi_request *current;
210
211 uint32_t dsa;
212 uint32_t temp;
213 uint32_t dnad;
214 uint32_t dbc;
215 uint8_t istat0;
216 uint8_t istat1;
217 uint8_t dcmd;
218 uint8_t dstat;
219 uint8_t dien;
220 uint8_t sist0;
221 uint8_t sist1;
222 uint8_t sien0;
223 uint8_t sien1;
224 uint8_t mbox0;
225 uint8_t mbox1;
226 uint8_t dfifo;
227 uint8_t ctest2;
228 uint8_t ctest3;
229 uint8_t ctest4;
230 uint8_t ctest5;
231 uint8_t ccntl0;
232 uint8_t ccntl1;
233 uint32_t dsp;
234 uint32_t dsps;
235 uint8_t dmode;
236 uint8_t dcntl;
237 uint8_t scntl0;
238 uint8_t scntl1;
239 uint8_t scntl2;
240 uint8_t scntl3;
241 uint8_t sstat0;
242 uint8_t sstat1;
243 uint8_t scid;
244 uint8_t sxfer;
245 uint8_t socl;
246 uint8_t sdid;
247 uint8_t ssid;
248 uint8_t sfbr;
249 uint8_t stest1;
250 uint8_t stest2;
251 uint8_t stest3;
252 uint8_t sidl;
253 uint8_t stime0;
254 uint8_t respid0;
255 uint8_t respid1;
256 uint32_t mmrs;
257 uint32_t mmws;
258 uint32_t sfs;
259 uint32_t drs;
260 uint32_t sbms;
261 uint32_t dbms;
262 uint32_t dnad64;
263 uint32_t pmjad1;
264 uint32_t pmjad2;
265 uint32_t rbc;
266 uint32_t ua;
267 uint32_t ia;
268 uint32_t sbc;
269 uint32_t csbc;
270 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
271 uint8_t sbr;
272
273 /* Script ram is stored as 32-bit words in host byteorder. */
274 uint32_t script_ram[2048];
275 } LSIState;
276
277 static inline int lsi_irq_on_rsl(LSIState *s)
278 {
279 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
280 }
281
282 static void lsi_soft_reset(LSIState *s)
283 {
284 lsi_request *p;
285
286 DPRINTF("Reset\n");
287 s->carry = 0;
288
289 s->msg_action = 0;
290 s->msg_len = 0;
291 s->waiting = 0;
292 s->dsa = 0;
293 s->dnad = 0;
294 s->dbc = 0;
295 s->temp = 0;
296 memset(s->scratch, 0, sizeof(s->scratch));
297 s->istat0 = 0;
298 s->istat1 = 0;
299 s->dcmd = 0x40;
300 s->dstat = LSI_DSTAT_DFE;
301 s->dien = 0;
302 s->sist0 = 0;
303 s->sist1 = 0;
304 s->sien0 = 0;
305 s->sien1 = 0;
306 s->mbox0 = 0;
307 s->mbox1 = 0;
308 s->dfifo = 0;
309 s->ctest2 = LSI_CTEST2_DACK;
310 s->ctest3 = 0;
311 s->ctest4 = 0;
312 s->ctest5 = 0;
313 s->ccntl0 = 0;
314 s->ccntl1 = 0;
315 s->dsp = 0;
316 s->dsps = 0;
317 s->dmode = 0;
318 s->dcntl = 0;
319 s->scntl0 = 0xc0;
320 s->scntl1 = 0;
321 s->scntl2 = 0;
322 s->scntl3 = 0;
323 s->sstat0 = 0;
324 s->sstat1 = 0;
325 s->scid = 7;
326 s->sxfer = 0;
327 s->socl = 0;
328 s->sdid = 0;
329 s->ssid = 0;
330 s->stest1 = 0;
331 s->stest2 = 0;
332 s->stest3 = 0;
333 s->sidl = 0;
334 s->stime0 = 0;
335 s->respid0 = 0x80;
336 s->respid1 = 0;
337 s->mmrs = 0;
338 s->mmws = 0;
339 s->sfs = 0;
340 s->drs = 0;
341 s->sbms = 0;
342 s->dbms = 0;
343 s->dnad64 = 0;
344 s->pmjad1 = 0;
345 s->pmjad2 = 0;
346 s->rbc = 0;
347 s->ua = 0;
348 s->ia = 0;
349 s->sbc = 0;
350 s->csbc = 0;
351 s->sbr = 0;
352 while (!QTAILQ_EMPTY(&s->queue)) {
353 p = QTAILQ_FIRST(&s->queue);
354 QTAILQ_REMOVE(&s->queue, p, next);
355 qemu_free(p);
356 }
357 if (s->current) {
358 qemu_free(s->current);
359 s->current = NULL;
360 }
361 }
362
363 static int lsi_dma_40bit(LSIState *s)
364 {
365 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
366 return 1;
367 return 0;
368 }
369
370 static int lsi_dma_ti64bit(LSIState *s)
371 {
372 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
373 return 1;
374 return 0;
375 }
376
377 static int lsi_dma_64bit(LSIState *s)
378 {
379 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
380 return 1;
381 return 0;
382 }
383
384 static uint8_t lsi_reg_readb(LSIState *s, int offset);
385 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
386 static void lsi_execute_script(LSIState *s);
387 static void lsi_reselect(LSIState *s, lsi_request *p);
388
389 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
390 {
391 uint32_t buf;
392
393 /* Optimize reading from SCRIPTS RAM. */
394 if ((addr & 0xffffe000) == s->script_ram_base) {
395 return s->script_ram[(addr & 0x1fff) >> 2];
396 }
397 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
398 return cpu_to_le32(buf);
399 }
400
401 static void lsi_stop_script(LSIState *s)
402 {
403 s->istat1 &= ~LSI_ISTAT1_SRUN;
404 }
405
406 static void lsi_update_irq(LSIState *s)
407 {
408 int level;
409 static int last_level;
410 lsi_request *p;
411
412 /* It's unclear whether the DIP/SIP bits should be cleared when the
413 Interrupt Status Registers are cleared or when istat0 is read.
414 We currently do the formwer, which seems to work. */
415 level = 0;
416 if (s->dstat) {
417 if (s->dstat & s->dien)
418 level = 1;
419 s->istat0 |= LSI_ISTAT0_DIP;
420 } else {
421 s->istat0 &= ~LSI_ISTAT0_DIP;
422 }
423
424 if (s->sist0 || s->sist1) {
425 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
426 level = 1;
427 s->istat0 |= LSI_ISTAT0_SIP;
428 } else {
429 s->istat0 &= ~LSI_ISTAT0_SIP;
430 }
431 if (s->istat0 & LSI_ISTAT0_INTF)
432 level = 1;
433
434 if (level != last_level) {
435 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
436 level, s->dstat, s->sist1, s->sist0);
437 last_level = level;
438 }
439 qemu_set_irq(s->dev.irq[0], level);
440
441 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
442 DPRINTF("Handled IRQs & disconnected, looking for pending "
443 "processes\n");
444 QTAILQ_FOREACH(p, &s->queue, next) {
445 if (p->pending) {
446 lsi_reselect(s, p);
447 break;
448 }
449 }
450 }
451 }
452
453 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
454 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
455 {
456 uint32_t mask0;
457 uint32_t mask1;
458
459 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
460 stat1, stat0, s->sist1, s->sist0);
461 s->sist0 |= stat0;
462 s->sist1 |= stat1;
463 /* Stop processor on fatal or unmasked interrupt. As a special hack
464 we don't stop processing when raising STO. Instead continue
465 execution and stop at the next insn that accesses the SCSI bus. */
466 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
467 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
468 mask1 &= ~LSI_SIST1_STO;
469 if (s->sist0 & mask0 || s->sist1 & mask1) {
470 lsi_stop_script(s);
471 }
472 lsi_update_irq(s);
473 }
474
475 /* Stop SCRIPTS execution and raise a DMA interrupt. */
476 static void lsi_script_dma_interrupt(LSIState *s, int stat)
477 {
478 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
479 s->dstat |= stat;
480 lsi_update_irq(s);
481 lsi_stop_script(s);
482 }
483
484 static inline void lsi_set_phase(LSIState *s, int phase)
485 {
486 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
487 }
488
489 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
490 {
491 /* Trigger a phase mismatch. */
492 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
493 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
494 s->dsp = out ? s->pmjad1 : s->pmjad2;
495 } else {
496 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
497 }
498 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
499 } else {
500 DPRINTF("Phase mismatch interrupt\n");
501 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
502 lsi_stop_script(s);
503 }
504 lsi_set_phase(s, new_phase);
505 }
506
507
508 /* Resume SCRIPTS execution after a DMA operation. */
509 static void lsi_resume_script(LSIState *s)
510 {
511 if (s->waiting != 2) {
512 s->waiting = 0;
513 lsi_execute_script(s);
514 } else {
515 s->waiting = 0;
516 }
517 }
518
519 static void lsi_disconnect(LSIState *s)
520 {
521 s->scntl1 &= ~LSI_SCNTL1_CON;
522 s->sstat1 &= ~PHASE_MASK;
523 }
524
525 static void lsi_bad_selection(LSIState *s, uint32_t id)
526 {
527 DPRINTF("Selected absent target %d\n", id);
528 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
529 lsi_disconnect(s);
530 }
531
532 /* Initiate a SCSI layer data transfer. */
533 static void lsi_do_dma(LSIState *s, int out)
534 {
535 uint32_t count, id;
536 target_phys_addr_t addr;
537 SCSIDevice *dev;
538
539 assert(s->current);
540 if (!s->current->dma_len) {
541 /* Wait until data is available. */
542 DPRINTF("DMA no data available\n");
543 return;
544 }
545
546 id = (s->current->tag >> 8) & 0xf;
547 dev = s->bus.devs[id];
548 if (!dev) {
549 lsi_bad_selection(s, id);
550 return;
551 }
552
553 count = s->dbc;
554 if (count > s->current->dma_len)
555 count = s->current->dma_len;
556
557 addr = s->dnad;
558 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
559 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
560 addr |= ((uint64_t)s->dnad64 << 32);
561 else if (s->dbms)
562 addr |= ((uint64_t)s->dbms << 32);
563 else if (s->sbms)
564 addr |= ((uint64_t)s->sbms << 32);
565
566 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
567 s->csbc += count;
568 s->dnad += count;
569 s->dbc -= count;
570
571 if (s->current->dma_buf == NULL) {
572 s->current->dma_buf = dev->info->get_buf(dev, s->current->tag);
573 }
574
575 /* ??? Set SFBR to first data byte. */
576 if (out) {
577 cpu_physical_memory_read(addr, s->current->dma_buf, count);
578 } else {
579 cpu_physical_memory_write(addr, s->current->dma_buf, count);
580 }
581 s->current->dma_len -= count;
582 if (s->current->dma_len == 0) {
583 s->current->dma_buf = NULL;
584 if (out) {
585 /* Write the data. */
586 dev->info->write_data(dev, s->current->tag);
587 } else {
588 /* Request any remaining data. */
589 dev->info->read_data(dev, s->current->tag);
590 }
591 } else {
592 s->current->dma_buf += count;
593 lsi_resume_script(s);
594 }
595 }
596
597
598 /* Add a command to the queue. */
599 static void lsi_queue_command(LSIState *s)
600 {
601 lsi_request *p = s->current;
602
603 DPRINTF("Queueing tag=0x%x\n", p->tag);
604 assert(s->current != NULL);
605 assert(s->current->dma_len == 0);
606 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
607 s->current = NULL;
608
609 p->pending = 0;
610 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
611 }
612
613 /* Queue a byte for a MSG IN phase. */
614 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
615 {
616 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
617 BADF("MSG IN data too long\n");
618 } else {
619 DPRINTF("MSG IN 0x%02x\n", data);
620 s->msg[s->msg_len++] = data;
621 }
622 }
623
624 /* Perform reselection to continue a command. */
625 static void lsi_reselect(LSIState *s, lsi_request *p)
626 {
627 int id;
628
629 assert(s->current == NULL);
630 QTAILQ_REMOVE(&s->queue, p, next);
631 s->current = p;
632
633 id = (p->tag >> 8) & 0xf;
634 s->ssid = id | 0x80;
635 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
636 if (!(s->dcntl & LSI_DCNTL_COM)) {
637 s->sfbr = 1 << (id & 0x7);
638 }
639 DPRINTF("Reselected target %d\n", id);
640 s->scntl1 |= LSI_SCNTL1_CON;
641 lsi_set_phase(s, PHASE_MI);
642 s->msg_action = p->out ? 2 : 3;
643 s->current->dma_len = p->pending;
644 lsi_add_msg_byte(s, 0x80);
645 if (s->current->tag & LSI_TAG_VALID) {
646 lsi_add_msg_byte(s, 0x20);
647 lsi_add_msg_byte(s, p->tag & 0xff);
648 }
649
650 if (lsi_irq_on_rsl(s)) {
651 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
652 }
653 }
654
655 /* Record that data is available for a queued command. Returns zero if
656 the device was reselected, nonzero if the IO is deferred. */
657 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
658 {
659 lsi_request *p;
660
661 QTAILQ_FOREACH(p, &s->queue, next) {
662 if (p->tag == tag) {
663 if (p->pending) {
664 BADF("Multiple IO pending for tag %d\n", tag);
665 }
666 p->pending = arg;
667 /* Reselect if waiting for it, or if reselection triggers an IRQ
668 and the bus is free.
669 Since no interrupt stacking is implemented in the emulation, it
670 is also required that there are no pending interrupts waiting
671 for service from the device driver. */
672 if (s->waiting == 1 ||
673 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
674 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
675 /* Reselect device. */
676 lsi_reselect(s, p);
677 return 0;
678 } else {
679 DPRINTF("Queueing IO tag=0x%x\n", tag);
680 p->pending = arg;
681 return 1;
682 }
683 }
684 }
685 BADF("IO with unknown tag %d\n", tag);
686 return 1;
687 }
688
689 /* Callback to indicate that the SCSI layer has completed a transfer. */
690 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
691 uint32_t arg)
692 {
693 LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
694 int out;
695
696 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
697 if (reason == SCSI_REASON_DONE) {
698 DPRINTF("Command complete sense=%d\n", (int)arg);
699 s->sense = arg;
700 s->command_complete = 2;
701 if (s->waiting && s->dbc != 0) {
702 /* Raise phase mismatch for short transfers. */
703 lsi_bad_phase(s, out, PHASE_ST);
704 } else {
705 lsi_set_phase(s, PHASE_ST);
706 }
707
708 qemu_free(s->current);
709 s->current = NULL;
710
711 lsi_resume_script(s);
712 return;
713 }
714
715 if (s->waiting == 1 || !s->current || tag != s->current->tag ||
716 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
717 if (lsi_queue_tag(s, tag, arg))
718 return;
719 }
720
721 /* host adapter (re)connected */
722 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
723 s->current->dma_len = arg;
724 s->command_complete = 1;
725 if (!s->waiting)
726 return;
727 if (s->waiting == 1 || s->dbc == 0) {
728 lsi_resume_script(s);
729 } else {
730 lsi_do_dma(s, out);
731 }
732 }
733
734 static void lsi_do_command(LSIState *s)
735 {
736 SCSIDevice *dev;
737 uint8_t buf[16];
738 uint32_t id;
739 int n;
740
741 DPRINTF("Send command len=%d\n", s->dbc);
742 if (s->dbc > 16)
743 s->dbc = 16;
744 cpu_physical_memory_read(s->dnad, buf, s->dbc);
745 s->sfbr = buf[0];
746 s->command_complete = 0;
747
748 id = (s->select_tag >> 8) & 0xf;
749 dev = s->bus.devs[id];
750 if (!dev) {
751 lsi_bad_selection(s, id);
752 return;
753 }
754
755 assert(s->current == NULL);
756 s->current = qemu_mallocz(sizeof(lsi_request));
757 s->current->tag = s->select_tag;
758
759 n = dev->info->send_command(dev, s->current->tag, buf, s->current_lun);
760 if (n > 0) {
761 lsi_set_phase(s, PHASE_DI);
762 dev->info->read_data(dev, s->current->tag);
763 } else if (n < 0) {
764 lsi_set_phase(s, PHASE_DO);
765 dev->info->write_data(dev, s->current->tag);
766 }
767
768 if (!s->command_complete) {
769 if (n) {
770 /* Command did not complete immediately so disconnect. */
771 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
772 lsi_add_msg_byte(s, 4); /* DISCONNECT */
773 /* wait data */
774 lsi_set_phase(s, PHASE_MI);
775 s->msg_action = 1;
776 lsi_queue_command(s);
777 } else {
778 /* wait command complete */
779 lsi_set_phase(s, PHASE_DI);
780 }
781 }
782 }
783
784 static void lsi_do_status(LSIState *s)
785 {
786 uint8_t sense;
787 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
788 if (s->dbc != 1)
789 BADF("Bad Status move\n");
790 s->dbc = 1;
791 sense = s->sense;
792 s->sfbr = sense;
793 cpu_physical_memory_write(s->dnad, &sense, 1);
794 lsi_set_phase(s, PHASE_MI);
795 s->msg_action = 1;
796 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
797 }
798
799 static void lsi_do_msgin(LSIState *s)
800 {
801 int len;
802 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
803 s->sfbr = s->msg[0];
804 len = s->msg_len;
805 if (len > s->dbc)
806 len = s->dbc;
807 cpu_physical_memory_write(s->dnad, s->msg, len);
808 /* Linux drivers rely on the last byte being in the SIDL. */
809 s->sidl = s->msg[len - 1];
810 s->msg_len -= len;
811 if (s->msg_len) {
812 memmove(s->msg, s->msg + len, s->msg_len);
813 } else {
814 /* ??? Check if ATN (not yet implemented) is asserted and maybe
815 switch to PHASE_MO. */
816 switch (s->msg_action) {
817 case 0:
818 lsi_set_phase(s, PHASE_CMD);
819 break;
820 case 1:
821 lsi_disconnect(s);
822 break;
823 case 2:
824 lsi_set_phase(s, PHASE_DO);
825 break;
826 case 3:
827 lsi_set_phase(s, PHASE_DI);
828 break;
829 default:
830 abort();
831 }
832 }
833 }
834
835 /* Read the next byte during a MSGOUT phase. */
836 static uint8_t lsi_get_msgbyte(LSIState *s)
837 {
838 uint8_t data;
839 cpu_physical_memory_read(s->dnad, &data, 1);
840 s->dnad++;
841 s->dbc--;
842 return data;
843 }
844
845 static void lsi_do_msgout(LSIState *s)
846 {
847 uint8_t msg;
848 int len;
849
850 DPRINTF("MSG out len=%d\n", s->dbc);
851 while (s->dbc) {
852 msg = lsi_get_msgbyte(s);
853 s->sfbr = msg;
854
855 switch (msg) {
856 case 0x04:
857 DPRINTF("MSG: Disconnect\n");
858 lsi_disconnect(s);
859 break;
860 case 0x08:
861 DPRINTF("MSG: No Operation\n");
862 lsi_set_phase(s, PHASE_CMD);
863 break;
864 case 0x01:
865 len = lsi_get_msgbyte(s);
866 msg = lsi_get_msgbyte(s);
867 (void)len; /* avoid a warning about unused variable*/
868 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
869 switch (msg) {
870 case 1:
871 DPRINTF("SDTR (ignored)\n");
872 s->dbc -= 2;
873 break;
874 case 3:
875 DPRINTF("WDTR (ignored)\n");
876 s->dbc -= 1;
877 break;
878 default:
879 goto bad;
880 }
881 break;
882 case 0x20: /* SIMPLE queue */
883 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
884 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
885 break;
886 case 0x21: /* HEAD of queue */
887 BADF("HEAD queue not implemented\n");
888 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
889 break;
890 case 0x22: /* ORDERED queue */
891 BADF("ORDERED queue not implemented\n");
892 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
893 break;
894 default:
895 if ((msg & 0x80) == 0) {
896 goto bad;
897 }
898 s->current_lun = msg & 7;
899 DPRINTF("Select LUN %d\n", s->current_lun);
900 lsi_set_phase(s, PHASE_CMD);
901 break;
902 }
903 }
904 return;
905 bad:
906 BADF("Unimplemented message 0x%02x\n", msg);
907 lsi_set_phase(s, PHASE_MI);
908 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
909 s->msg_action = 0;
910 }
911
912 /* Sign extend a 24-bit value. */
913 static inline int32_t sxt24(int32_t n)
914 {
915 return (n << 8) >> 8;
916 }
917
918 #define LSI_BUF_SIZE 4096
919 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
920 {
921 int n;
922 uint8_t buf[LSI_BUF_SIZE];
923
924 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
925 while (count) {
926 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
927 cpu_physical_memory_read(src, buf, n);
928 cpu_physical_memory_write(dest, buf, n);
929 src += n;
930 dest += n;
931 count -= n;
932 }
933 }
934
935 static void lsi_wait_reselect(LSIState *s)
936 {
937 lsi_request *p;
938
939 DPRINTF("Wait Reselect\n");
940
941 QTAILQ_FOREACH(p, &s->queue, next) {
942 if (p->pending) {
943 lsi_reselect(s, p);
944 break;
945 }
946 }
947 if (s->current == NULL) {
948 s->waiting = 1;
949 }
950 }
951
952 static void lsi_execute_script(LSIState *s)
953 {
954 uint32_t insn;
955 uint32_t addr, addr_high;
956 int opcode;
957 int insn_processed = 0;
958
959 s->istat1 |= LSI_ISTAT1_SRUN;
960 again:
961 insn_processed++;
962 insn = read_dword(s, s->dsp);
963 if (!insn) {
964 /* If we receive an empty opcode increment the DSP by 4 bytes
965 instead of 8 and execute the next opcode at that location */
966 s->dsp += 4;
967 goto again;
968 }
969 addr = read_dword(s, s->dsp + 4);
970 addr_high = 0;
971 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
972 s->dsps = addr;
973 s->dcmd = insn >> 24;
974 s->dsp += 8;
975 switch (insn >> 30) {
976 case 0: /* Block move. */
977 if (s->sist1 & LSI_SIST1_STO) {
978 DPRINTF("Delayed select timeout\n");
979 lsi_stop_script(s);
980 break;
981 }
982 s->dbc = insn & 0xffffff;
983 s->rbc = s->dbc;
984 /* ??? Set ESA. */
985 s->ia = s->dsp - 8;
986 if (insn & (1 << 29)) {
987 /* Indirect addressing. */
988 addr = read_dword(s, addr);
989 } else if (insn & (1 << 28)) {
990 uint32_t buf[2];
991 int32_t offset;
992 /* Table indirect addressing. */
993
994 /* 32-bit Table indirect */
995 offset = sxt24(addr);
996 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
997 /* byte count is stored in bits 0:23 only */
998 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
999 s->rbc = s->dbc;
1000 addr = cpu_to_le32(buf[1]);
1001
1002 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1003 * table, bits [31:24] */
1004 if (lsi_dma_40bit(s))
1005 addr_high = cpu_to_le32(buf[0]) >> 24;
1006 else if (lsi_dma_ti64bit(s)) {
1007 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1008 switch (selector) {
1009 case 0 ... 0x0f:
1010 /* offset index into scratch registers since
1011 * TI64 mode can use registers C to R */
1012 addr_high = s->scratch[2 + selector];
1013 break;
1014 case 0x10:
1015 addr_high = s->mmrs;
1016 break;
1017 case 0x11:
1018 addr_high = s->mmws;
1019 break;
1020 case 0x12:
1021 addr_high = s->sfs;
1022 break;
1023 case 0x13:
1024 addr_high = s->drs;
1025 break;
1026 case 0x14:
1027 addr_high = s->sbms;
1028 break;
1029 case 0x15:
1030 addr_high = s->dbms;
1031 break;
1032 default:
1033 BADF("Illegal selector specified (0x%x > 0x15)"
1034 " for 64-bit DMA block move", selector);
1035 break;
1036 }
1037 }
1038 } else if (lsi_dma_64bit(s)) {
1039 /* fetch a 3rd dword if 64-bit direct move is enabled and
1040 only if we're not doing table indirect or indirect addressing */
1041 s->dbms = read_dword(s, s->dsp);
1042 s->dsp += 4;
1043 s->ia = s->dsp - 12;
1044 }
1045 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1046 DPRINTF("Wrong phase got %d expected %d\n",
1047 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1048 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1049 break;
1050 }
1051 s->dnad = addr;
1052 s->dnad64 = addr_high;
1053 switch (s->sstat1 & 0x7) {
1054 case PHASE_DO:
1055 s->waiting = 2;
1056 lsi_do_dma(s, 1);
1057 if (s->waiting)
1058 s->waiting = 3;
1059 break;
1060 case PHASE_DI:
1061 s->waiting = 2;
1062 lsi_do_dma(s, 0);
1063 if (s->waiting)
1064 s->waiting = 3;
1065 break;
1066 case PHASE_CMD:
1067 lsi_do_command(s);
1068 break;
1069 case PHASE_ST:
1070 lsi_do_status(s);
1071 break;
1072 case PHASE_MO:
1073 lsi_do_msgout(s);
1074 break;
1075 case PHASE_MI:
1076 lsi_do_msgin(s);
1077 break;
1078 default:
1079 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1080 exit(1);
1081 }
1082 s->dfifo = s->dbc & 0xff;
1083 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1084 s->sbc = s->dbc;
1085 s->rbc -= s->dbc;
1086 s->ua = addr + s->dbc;
1087 break;
1088
1089 case 1: /* IO or Read/Write instruction. */
1090 opcode = (insn >> 27) & 7;
1091 if (opcode < 5) {
1092 uint32_t id;
1093
1094 if (insn & (1 << 25)) {
1095 id = read_dword(s, s->dsa + sxt24(insn));
1096 } else {
1097 id = insn;
1098 }
1099 id = (id >> 16) & 0xf;
1100 if (insn & (1 << 26)) {
1101 addr = s->dsp + sxt24(addr);
1102 }
1103 s->dnad = addr;
1104 switch (opcode) {
1105 case 0: /* Select */
1106 s->sdid = id;
1107 if (s->scntl1 & LSI_SCNTL1_CON) {
1108 DPRINTF("Already reselected, jumping to alternative address\n");
1109 s->dsp = s->dnad;
1110 break;
1111 }
1112 s->sstat0 |= LSI_SSTAT0_WOA;
1113 s->scntl1 &= ~LSI_SCNTL1_IARB;
1114 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1115 lsi_bad_selection(s, id);
1116 break;
1117 }
1118 DPRINTF("Selected target %d%s\n",
1119 id, insn & (1 << 3) ? " ATN" : "");
1120 /* ??? Linux drivers compain when this is set. Maybe
1121 it only applies in low-level mode (unimplemented).
1122 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1123 s->select_tag = id << 8;
1124 s->scntl1 |= LSI_SCNTL1_CON;
1125 if (insn & (1 << 3)) {
1126 s->socl |= LSI_SOCL_ATN;
1127 }
1128 lsi_set_phase(s, PHASE_MO);
1129 break;
1130 case 1: /* Disconnect */
1131 DPRINTF("Wait Disconnect\n");
1132 s->scntl1 &= ~LSI_SCNTL1_CON;
1133 break;
1134 case 2: /* Wait Reselect */
1135 if (!lsi_irq_on_rsl(s)) {
1136 lsi_wait_reselect(s);
1137 }
1138 break;
1139 case 3: /* Set */
1140 DPRINTF("Set%s%s%s%s\n",
1141 insn & (1 << 3) ? " ATN" : "",
1142 insn & (1 << 6) ? " ACK" : "",
1143 insn & (1 << 9) ? " TM" : "",
1144 insn & (1 << 10) ? " CC" : "");
1145 if (insn & (1 << 3)) {
1146 s->socl |= LSI_SOCL_ATN;
1147 lsi_set_phase(s, PHASE_MO);
1148 }
1149 if (insn & (1 << 9)) {
1150 BADF("Target mode not implemented\n");
1151 exit(1);
1152 }
1153 if (insn & (1 << 10))
1154 s->carry = 1;
1155 break;
1156 case 4: /* Clear */
1157 DPRINTF("Clear%s%s%s%s\n",
1158 insn & (1 << 3) ? " ATN" : "",
1159 insn & (1 << 6) ? " ACK" : "",
1160 insn & (1 << 9) ? " TM" : "",
1161 insn & (1 << 10) ? " CC" : "");
1162 if (insn & (1 << 3)) {
1163 s->socl &= ~LSI_SOCL_ATN;
1164 }
1165 if (insn & (1 << 10))
1166 s->carry = 0;
1167 break;
1168 }
1169 } else {
1170 uint8_t op0;
1171 uint8_t op1;
1172 uint8_t data8;
1173 int reg;
1174 int operator;
1175 #ifdef DEBUG_LSI
1176 static const char *opcode_names[3] =
1177 {"Write", "Read", "Read-Modify-Write"};
1178 static const char *operator_names[8] =
1179 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1180 #endif
1181
1182 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1183 data8 = (insn >> 8) & 0xff;
1184 opcode = (insn >> 27) & 7;
1185 operator = (insn >> 24) & 7;
1186 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1187 opcode_names[opcode - 5], reg,
1188 operator_names[operator], data8, s->sfbr,
1189 (insn & (1 << 23)) ? " SFBR" : "");
1190 op0 = op1 = 0;
1191 switch (opcode) {
1192 case 5: /* From SFBR */
1193 op0 = s->sfbr;
1194 op1 = data8;
1195 break;
1196 case 6: /* To SFBR */
1197 if (operator)
1198 op0 = lsi_reg_readb(s, reg);
1199 op1 = data8;
1200 break;
1201 case 7: /* Read-modify-write */
1202 if (operator)
1203 op0 = lsi_reg_readb(s, reg);
1204 if (insn & (1 << 23)) {
1205 op1 = s->sfbr;
1206 } else {
1207 op1 = data8;
1208 }
1209 break;
1210 }
1211
1212 switch (operator) {
1213 case 0: /* move */
1214 op0 = op1;
1215 break;
1216 case 1: /* Shift left */
1217 op1 = op0 >> 7;
1218 op0 = (op0 << 1) | s->carry;
1219 s->carry = op1;
1220 break;
1221 case 2: /* OR */
1222 op0 |= op1;
1223 break;
1224 case 3: /* XOR */
1225 op0 ^= op1;
1226 break;
1227 case 4: /* AND */
1228 op0 &= op1;
1229 break;
1230 case 5: /* SHR */
1231 op1 = op0 & 1;
1232 op0 = (op0 >> 1) | (s->carry << 7);
1233 s->carry = op1;
1234 break;
1235 case 6: /* ADD */
1236 op0 += op1;
1237 s->carry = op0 < op1;
1238 break;
1239 case 7: /* ADC */
1240 op0 += op1 + s->carry;
1241 if (s->carry)
1242 s->carry = op0 <= op1;
1243 else
1244 s->carry = op0 < op1;
1245 break;
1246 }
1247
1248 switch (opcode) {
1249 case 5: /* From SFBR */
1250 case 7: /* Read-modify-write */
1251 lsi_reg_writeb(s, reg, op0);
1252 break;
1253 case 6: /* To SFBR */
1254 s->sfbr = op0;
1255 break;
1256 }
1257 }
1258 break;
1259
1260 case 2: /* Transfer Control. */
1261 {
1262 int cond;
1263 int jmp;
1264
1265 if ((insn & 0x002e0000) == 0) {
1266 DPRINTF("NOP\n");
1267 break;
1268 }
1269 if (s->sist1 & LSI_SIST1_STO) {
1270 DPRINTF("Delayed select timeout\n");
1271 lsi_stop_script(s);
1272 break;
1273 }
1274 cond = jmp = (insn & (1 << 19)) != 0;
1275 if (cond == jmp && (insn & (1 << 21))) {
1276 DPRINTF("Compare carry %d\n", s->carry == jmp);
1277 cond = s->carry != 0;
1278 }
1279 if (cond == jmp && (insn & (1 << 17))) {
1280 DPRINTF("Compare phase %d %c= %d\n",
1281 (s->sstat1 & PHASE_MASK),
1282 jmp ? '=' : '!',
1283 ((insn >> 24) & 7));
1284 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1285 }
1286 if (cond == jmp && (insn & (1 << 18))) {
1287 uint8_t mask;
1288
1289 mask = (~insn >> 8) & 0xff;
1290 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1291 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1292 cond = (s->sfbr & mask) == (insn & mask);
1293 }
1294 if (cond == jmp) {
1295 if (insn & (1 << 23)) {
1296 /* Relative address. */
1297 addr = s->dsp + sxt24(addr);
1298 }
1299 switch ((insn >> 27) & 7) {
1300 case 0: /* Jump */
1301 DPRINTF("Jump to 0x%08x\n", addr);
1302 s->dsp = addr;
1303 break;
1304 case 1: /* Call */
1305 DPRINTF("Call 0x%08x\n", addr);
1306 s->temp = s->dsp;
1307 s->dsp = addr;
1308 break;
1309 case 2: /* Return */
1310 DPRINTF("Return to 0x%08x\n", s->temp);
1311 s->dsp = s->temp;
1312 break;
1313 case 3: /* Interrupt */
1314 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1315 if ((insn & (1 << 20)) != 0) {
1316 s->istat0 |= LSI_ISTAT0_INTF;
1317 lsi_update_irq(s);
1318 } else {
1319 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1320 }
1321 break;
1322 default:
1323 DPRINTF("Illegal transfer control\n");
1324 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1325 break;
1326 }
1327 } else {
1328 DPRINTF("Control condition failed\n");
1329 }
1330 }
1331 break;
1332
1333 case 3:
1334 if ((insn & (1 << 29)) == 0) {
1335 /* Memory move. */
1336 uint32_t dest;
1337 /* ??? The docs imply the destination address is loaded into
1338 the TEMP register. However the Linux drivers rely on
1339 the value being presrved. */
1340 dest = read_dword(s, s->dsp);
1341 s->dsp += 4;
1342 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1343 } else {
1344 uint8_t data[7];
1345 int reg;
1346 int n;
1347 int i;
1348
1349 if (insn & (1 << 28)) {
1350 addr = s->dsa + sxt24(addr);
1351 }
1352 n = (insn & 7);
1353 reg = (insn >> 16) & 0xff;
1354 if (insn & (1 << 24)) {
1355 cpu_physical_memory_read(addr, data, n);
1356 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1357 addr, *(int *)data);
1358 for (i = 0; i < n; i++) {
1359 lsi_reg_writeb(s, reg + i, data[i]);
1360 }
1361 } else {
1362 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1363 for (i = 0; i < n; i++) {
1364 data[i] = lsi_reg_readb(s, reg + i);
1365 }
1366 cpu_physical_memory_write(addr, data, n);
1367 }
1368 }
1369 }
1370 if (insn_processed > 10000 && !s->waiting) {
1371 /* Some windows drivers make the device spin waiting for a memory
1372 location to change. If we have been executed a lot of code then
1373 assume this is the case and force an unexpected device disconnect.
1374 This is apparently sufficient to beat the drivers into submission.
1375 */
1376 if (!(s->sien0 & LSI_SIST0_UDC))
1377 fprintf(stderr, "inf. loop with UDC masked\n");
1378 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1379 lsi_disconnect(s);
1380 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1381 if (s->dcntl & LSI_DCNTL_SSM) {
1382 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1383 } else {
1384 goto again;
1385 }
1386 }
1387 DPRINTF("SCRIPTS execution stopped\n");
1388 }
1389
1390 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1391 {
1392 uint8_t tmp;
1393 #define CASE_GET_REG24(name, addr) \
1394 case addr: return s->name & 0xff; \
1395 case addr + 1: return (s->name >> 8) & 0xff; \
1396 case addr + 2: return (s->name >> 16) & 0xff;
1397
1398 #define CASE_GET_REG32(name, addr) \
1399 case addr: return s->name & 0xff; \
1400 case addr + 1: return (s->name >> 8) & 0xff; \
1401 case addr + 2: return (s->name >> 16) & 0xff; \
1402 case addr + 3: return (s->name >> 24) & 0xff;
1403
1404 #ifdef DEBUG_LSI_REG
1405 DPRINTF("Read reg %x\n", offset);
1406 #endif
1407 switch (offset) {
1408 case 0x00: /* SCNTL0 */
1409 return s->scntl0;
1410 case 0x01: /* SCNTL1 */
1411 return s->scntl1;
1412 case 0x02: /* SCNTL2 */
1413 return s->scntl2;
1414 case 0x03: /* SCNTL3 */
1415 return s->scntl3;
1416 case 0x04: /* SCID */
1417 return s->scid;
1418 case 0x05: /* SXFER */
1419 return s->sxfer;
1420 case 0x06: /* SDID */
1421 return s->sdid;
1422 case 0x07: /* GPREG0 */
1423 return 0x7f;
1424 case 0x08: /* Revision ID */
1425 return 0x00;
1426 case 0xa: /* SSID */
1427 return s->ssid;
1428 case 0xb: /* SBCL */
1429 /* ??? This is not correct. However it's (hopefully) only
1430 used for diagnostics, so should be ok. */
1431 return 0;
1432 case 0xc: /* DSTAT */
1433 tmp = s->dstat | 0x80;
1434 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1435 s->dstat = 0;
1436 lsi_update_irq(s);
1437 return tmp;
1438 case 0x0d: /* SSTAT0 */
1439 return s->sstat0;
1440 case 0x0e: /* SSTAT1 */
1441 return s->sstat1;
1442 case 0x0f: /* SSTAT2 */
1443 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1444 CASE_GET_REG32(dsa, 0x10)
1445 case 0x14: /* ISTAT0 */
1446 return s->istat0;
1447 case 0x15: /* ISTAT1 */
1448 return s->istat1;
1449 case 0x16: /* MBOX0 */
1450 return s->mbox0;
1451 case 0x17: /* MBOX1 */
1452 return s->mbox1;
1453 case 0x18: /* CTEST0 */
1454 return 0xff;
1455 case 0x19: /* CTEST1 */
1456 return 0;
1457 case 0x1a: /* CTEST2 */
1458 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1459 if (s->istat0 & LSI_ISTAT0_SIGP) {
1460 s->istat0 &= ~LSI_ISTAT0_SIGP;
1461 tmp |= LSI_CTEST2_SIGP;
1462 }
1463 return tmp;
1464 case 0x1b: /* CTEST3 */
1465 return s->ctest3;
1466 CASE_GET_REG32(temp, 0x1c)
1467 case 0x20: /* DFIFO */
1468 return 0;
1469 case 0x21: /* CTEST4 */
1470 return s->ctest4;
1471 case 0x22: /* CTEST5 */
1472 return s->ctest5;
1473 case 0x23: /* CTEST6 */
1474 return 0;
1475 CASE_GET_REG24(dbc, 0x24)
1476 case 0x27: /* DCMD */
1477 return s->dcmd;
1478 CASE_GET_REG32(dnad, 0x28)
1479 CASE_GET_REG32(dsp, 0x2c)
1480 CASE_GET_REG32(dsps, 0x30)
1481 CASE_GET_REG32(scratch[0], 0x34)
1482 case 0x38: /* DMODE */
1483 return s->dmode;
1484 case 0x39: /* DIEN */
1485 return s->dien;
1486 case 0x3a: /* SBR */
1487 return s->sbr;
1488 case 0x3b: /* DCNTL */
1489 return s->dcntl;
1490 case 0x40: /* SIEN0 */
1491 return s->sien0;
1492 case 0x41: /* SIEN1 */
1493 return s->sien1;
1494 case 0x42: /* SIST0 */
1495 tmp = s->sist0;
1496 s->sist0 = 0;
1497 lsi_update_irq(s);
1498 return tmp;
1499 case 0x43: /* SIST1 */
1500 tmp = s->sist1;
1501 s->sist1 = 0;
1502 lsi_update_irq(s);
1503 return tmp;
1504 case 0x46: /* MACNTL */
1505 return 0x0f;
1506 case 0x47: /* GPCNTL0 */
1507 return 0x0f;
1508 case 0x48: /* STIME0 */
1509 return s->stime0;
1510 case 0x4a: /* RESPID0 */
1511 return s->respid0;
1512 case 0x4b: /* RESPID1 */
1513 return s->respid1;
1514 case 0x4d: /* STEST1 */
1515 return s->stest1;
1516 case 0x4e: /* STEST2 */
1517 return s->stest2;
1518 case 0x4f: /* STEST3 */
1519 return s->stest3;
1520 case 0x50: /* SIDL */
1521 /* This is needed by the linux drivers. We currently only update it
1522 during the MSG IN phase. */
1523 return s->sidl;
1524 case 0x52: /* STEST4 */
1525 return 0xe0;
1526 case 0x56: /* CCNTL0 */
1527 return s->ccntl0;
1528 case 0x57: /* CCNTL1 */
1529 return s->ccntl1;
1530 case 0x58: /* SBDL */
1531 /* Some drivers peek at the data bus during the MSG IN phase. */
1532 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1533 return s->msg[0];
1534 return 0;
1535 case 0x59: /* SBDL high */
1536 return 0;
1537 CASE_GET_REG32(mmrs, 0xa0)
1538 CASE_GET_REG32(mmws, 0xa4)
1539 CASE_GET_REG32(sfs, 0xa8)
1540 CASE_GET_REG32(drs, 0xac)
1541 CASE_GET_REG32(sbms, 0xb0)
1542 CASE_GET_REG32(dbms, 0xb4)
1543 CASE_GET_REG32(dnad64, 0xb8)
1544 CASE_GET_REG32(pmjad1, 0xc0)
1545 CASE_GET_REG32(pmjad2, 0xc4)
1546 CASE_GET_REG32(rbc, 0xc8)
1547 CASE_GET_REG32(ua, 0xcc)
1548 CASE_GET_REG32(ia, 0xd4)
1549 CASE_GET_REG32(sbc, 0xd8)
1550 CASE_GET_REG32(csbc, 0xdc)
1551 }
1552 if (offset >= 0x5c && offset < 0xa0) {
1553 int n;
1554 int shift;
1555 n = (offset - 0x58) >> 2;
1556 shift = (offset & 3) * 8;
1557 return (s->scratch[n] >> shift) & 0xff;
1558 }
1559 BADF("readb 0x%x\n", offset);
1560 exit(1);
1561 #undef CASE_GET_REG24
1562 #undef CASE_GET_REG32
1563 }
1564
1565 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1566 {
1567 #define CASE_SET_REG24(name, addr) \
1568 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1569 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1570 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1571
1572 #define CASE_SET_REG32(name, addr) \
1573 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1574 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1575 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1576 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1577
1578 #ifdef DEBUG_LSI_REG
1579 DPRINTF("Write reg %x = %02x\n", offset, val);
1580 #endif
1581 switch (offset) {
1582 case 0x00: /* SCNTL0 */
1583 s->scntl0 = val;
1584 if (val & LSI_SCNTL0_START) {
1585 BADF("Start sequence not implemented\n");
1586 }
1587 break;
1588 case 0x01: /* SCNTL1 */
1589 s->scntl1 = val & ~LSI_SCNTL1_SST;
1590 if (val & LSI_SCNTL1_IARB) {
1591 BADF("Immediate Arbritration not implemented\n");
1592 }
1593 if (val & LSI_SCNTL1_RST) {
1594 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1595 DeviceState *dev;
1596 int id;
1597
1598 for (id = 0; id < s->bus.ndev; id++) {
1599 if (s->bus.devs[id]) {
1600 dev = &s->bus.devs[id]->qdev;
1601 dev->info->reset(dev);
1602 }
1603 }
1604 s->sstat0 |= LSI_SSTAT0_RST;
1605 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1606 }
1607 } else {
1608 s->sstat0 &= ~LSI_SSTAT0_RST;
1609 }
1610 break;
1611 case 0x02: /* SCNTL2 */
1612 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1613 s->scntl2 = val;
1614 break;
1615 case 0x03: /* SCNTL3 */
1616 s->scntl3 = val;
1617 break;
1618 case 0x04: /* SCID */
1619 s->scid = val;
1620 break;
1621 case 0x05: /* SXFER */
1622 s->sxfer = val;
1623 break;
1624 case 0x06: /* SDID */
1625 if ((val & 0xf) != (s->ssid & 0xf))
1626 BADF("Destination ID does not match SSID\n");
1627 s->sdid = val & 0xf;
1628 break;
1629 case 0x07: /* GPREG0 */
1630 break;
1631 case 0x08: /* SFBR */
1632 /* The CPU is not allowed to write to this register. However the
1633 SCRIPTS register move instructions are. */
1634 s->sfbr = val;
1635 break;
1636 case 0x0a: case 0x0b:
1637 /* Openserver writes to these readonly registers on startup */
1638 return;
1639 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1640 /* Linux writes to these readonly registers on startup. */
1641 return;
1642 CASE_SET_REG32(dsa, 0x10)
1643 case 0x14: /* ISTAT0 */
1644 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1645 if (val & LSI_ISTAT0_ABRT) {
1646 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1647 }
1648 if (val & LSI_ISTAT0_INTF) {
1649 s->istat0 &= ~LSI_ISTAT0_INTF;
1650 lsi_update_irq(s);
1651 }
1652 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1653 DPRINTF("Woken by SIGP\n");
1654 s->waiting = 0;
1655 s->dsp = s->dnad;
1656 lsi_execute_script(s);
1657 }
1658 if (val & LSI_ISTAT0_SRST) {
1659 lsi_soft_reset(s);
1660 }
1661 break;
1662 case 0x16: /* MBOX0 */
1663 s->mbox0 = val;
1664 break;
1665 case 0x17: /* MBOX1 */
1666 s->mbox1 = val;
1667 break;
1668 case 0x1a: /* CTEST2 */
1669 s->ctest2 = val & LSI_CTEST2_PCICIE;
1670 break;
1671 case 0x1b: /* CTEST3 */
1672 s->ctest3 = val & 0x0f;
1673 break;
1674 CASE_SET_REG32(temp, 0x1c)
1675 case 0x21: /* CTEST4 */
1676 if (val & 7) {
1677 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1678 }
1679 s->ctest4 = val;
1680 break;
1681 case 0x22: /* CTEST5 */
1682 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1683 BADF("CTEST5 DMA increment not implemented\n");
1684 }
1685 s->ctest5 = val;
1686 break;
1687 CASE_SET_REG24(dbc, 0x24)
1688 CASE_SET_REG32(dnad, 0x28)
1689 case 0x2c: /* DSP[0:7] */
1690 s->dsp &= 0xffffff00;
1691 s->dsp |= val;
1692 break;
1693 case 0x2d: /* DSP[8:15] */
1694 s->dsp &= 0xffff00ff;
1695 s->dsp |= val << 8;
1696 break;
1697 case 0x2e: /* DSP[16:23] */
1698 s->dsp &= 0xff00ffff;
1699 s->dsp |= val << 16;
1700 break;
1701 case 0x2f: /* DSP[24:31] */
1702 s->dsp &= 0x00ffffff;
1703 s->dsp |= val << 24;
1704 if ((s->dmode & LSI_DMODE_MAN) == 0
1705 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1706 lsi_execute_script(s);
1707 break;
1708 CASE_SET_REG32(dsps, 0x30)
1709 CASE_SET_REG32(scratch[0], 0x34)
1710 case 0x38: /* DMODE */
1711 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1712 BADF("IO mappings not implemented\n");
1713 }
1714 s->dmode = val;
1715 break;
1716 case 0x39: /* DIEN */
1717 s->dien = val;
1718 lsi_update_irq(s);
1719 break;
1720 case 0x3a: /* SBR */
1721 s->sbr = val;
1722 break;
1723 case 0x3b: /* DCNTL */
1724 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1725 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1726 lsi_execute_script(s);
1727 break;
1728 case 0x40: /* SIEN0 */
1729 s->sien0 = val;
1730 lsi_update_irq(s);
1731 break;
1732 case 0x41: /* SIEN1 */
1733 s->sien1 = val;
1734 lsi_update_irq(s);
1735 break;
1736 case 0x47: /* GPCNTL0 */
1737 break;
1738 case 0x48: /* STIME0 */
1739 s->stime0 = val;
1740 break;
1741 case 0x49: /* STIME1 */
1742 if (val & 0xf) {
1743 DPRINTF("General purpose timer not implemented\n");
1744 /* ??? Raising the interrupt immediately seems to be sufficient
1745 to keep the FreeBSD driver happy. */
1746 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1747 }
1748 break;
1749 case 0x4a: /* RESPID0 */
1750 s->respid0 = val;
1751 break;
1752 case 0x4b: /* RESPID1 */
1753 s->respid1 = val;
1754 break;
1755 case 0x4d: /* STEST1 */
1756 s->stest1 = val;
1757 break;
1758 case 0x4e: /* STEST2 */
1759 if (val & 1) {
1760 BADF("Low level mode not implemented\n");
1761 }
1762 s->stest2 = val;
1763 break;
1764 case 0x4f: /* STEST3 */
1765 if (val & 0x41) {
1766 BADF("SCSI FIFO test mode not implemented\n");
1767 }
1768 s->stest3 = val;
1769 break;
1770 case 0x56: /* CCNTL0 */
1771 s->ccntl0 = val;
1772 break;
1773 case 0x57: /* CCNTL1 */
1774 s->ccntl1 = val;
1775 break;
1776 CASE_SET_REG32(mmrs, 0xa0)
1777 CASE_SET_REG32(mmws, 0xa4)
1778 CASE_SET_REG32(sfs, 0xa8)
1779 CASE_SET_REG32(drs, 0xac)
1780 CASE_SET_REG32(sbms, 0xb0)
1781 CASE_SET_REG32(dbms, 0xb4)
1782 CASE_SET_REG32(dnad64, 0xb8)
1783 CASE_SET_REG32(pmjad1, 0xc0)
1784 CASE_SET_REG32(pmjad2, 0xc4)
1785 CASE_SET_REG32(rbc, 0xc8)
1786 CASE_SET_REG32(ua, 0xcc)
1787 CASE_SET_REG32(ia, 0xd4)
1788 CASE_SET_REG32(sbc, 0xd8)
1789 CASE_SET_REG32(csbc, 0xdc)
1790 default:
1791 if (offset >= 0x5c && offset < 0xa0) {
1792 int n;
1793 int shift;
1794 n = (offset - 0x58) >> 2;
1795 shift = (offset & 3) * 8;
1796 s->scratch[n] &= ~(0xff << shift);
1797 s->scratch[n] |= (val & 0xff) << shift;
1798 } else {
1799 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1800 }
1801 }
1802 #undef CASE_SET_REG24
1803 #undef CASE_SET_REG32
1804 }
1805
1806 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1807 {
1808 LSIState *s = opaque;
1809
1810 lsi_reg_writeb(s, addr & 0xff, val);
1811 }
1812
1813 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1814 {
1815 LSIState *s = opaque;
1816
1817 addr &= 0xff;
1818 lsi_reg_writeb(s, addr, val & 0xff);
1819 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1820 }
1821
1822 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1823 {
1824 LSIState *s = opaque;
1825
1826 addr &= 0xff;
1827 lsi_reg_writeb(s, addr, val & 0xff);
1828 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1829 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1830 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1831 }
1832
1833 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1834 {
1835 LSIState *s = opaque;
1836
1837 return lsi_reg_readb(s, addr & 0xff);
1838 }
1839
1840 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1841 {
1842 LSIState *s = opaque;
1843 uint32_t val;
1844
1845 addr &= 0xff;
1846 val = lsi_reg_readb(s, addr);
1847 val |= lsi_reg_readb(s, addr + 1) << 8;
1848 return val;
1849 }
1850
1851 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1852 {
1853 LSIState *s = opaque;
1854 uint32_t val;
1855 addr &= 0xff;
1856 val = lsi_reg_readb(s, addr);
1857 val |= lsi_reg_readb(s, addr + 1) << 8;
1858 val |= lsi_reg_readb(s, addr + 2) << 16;
1859 val |= lsi_reg_readb(s, addr + 3) << 24;
1860 return val;
1861 }
1862
1863 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1864 lsi_mmio_readb,
1865 lsi_mmio_readw,
1866 lsi_mmio_readl,
1867 };
1868
1869 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1870 lsi_mmio_writeb,
1871 lsi_mmio_writew,
1872 lsi_mmio_writel,
1873 };
1874
1875 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1876 {
1877 LSIState *s = opaque;
1878 uint32_t newval;
1879 int shift;
1880
1881 addr &= 0x1fff;
1882 newval = s->script_ram[addr >> 2];
1883 shift = (addr & 3) * 8;
1884 newval &= ~(0xff << shift);
1885 newval |= val << shift;
1886 s->script_ram[addr >> 2] = newval;
1887 }
1888
1889 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1890 {
1891 LSIState *s = opaque;
1892 uint32_t newval;
1893
1894 addr &= 0x1fff;
1895 newval = s->script_ram[addr >> 2];
1896 if (addr & 2) {
1897 newval = (newval & 0xffff) | (val << 16);
1898 } else {
1899 newval = (newval & 0xffff0000) | val;
1900 }
1901 s->script_ram[addr >> 2] = newval;
1902 }
1903
1904
1905 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1906 {
1907 LSIState *s = opaque;
1908
1909 addr &= 0x1fff;
1910 s->script_ram[addr >> 2] = val;
1911 }
1912
1913 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1914 {
1915 LSIState *s = opaque;
1916 uint32_t val;
1917
1918 addr &= 0x1fff;
1919 val = s->script_ram[addr >> 2];
1920 val >>= (addr & 3) * 8;
1921 return val & 0xff;
1922 }
1923
1924 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1925 {
1926 LSIState *s = opaque;
1927 uint32_t val;
1928
1929 addr &= 0x1fff;
1930 val = s->script_ram[addr >> 2];
1931 if (addr & 2)
1932 val >>= 16;
1933 return le16_to_cpu(val);
1934 }
1935
1936 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1937 {
1938 LSIState *s = opaque;
1939
1940 addr &= 0x1fff;
1941 return le32_to_cpu(s->script_ram[addr >> 2]);
1942 }
1943
1944 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1945 lsi_ram_readb,
1946 lsi_ram_readw,
1947 lsi_ram_readl,
1948 };
1949
1950 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1951 lsi_ram_writeb,
1952 lsi_ram_writew,
1953 lsi_ram_writel,
1954 };
1955
1956 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1957 {
1958 LSIState *s = opaque;
1959 return lsi_reg_readb(s, addr & 0xff);
1960 }
1961
1962 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1963 {
1964 LSIState *s = opaque;
1965 uint32_t val;
1966 addr &= 0xff;
1967 val = lsi_reg_readb(s, addr);
1968 val |= lsi_reg_readb(s, addr + 1) << 8;
1969 return val;
1970 }
1971
1972 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1973 {
1974 LSIState *s = opaque;
1975 uint32_t val;
1976 addr &= 0xff;
1977 val = lsi_reg_readb(s, addr);
1978 val |= lsi_reg_readb(s, addr + 1) << 8;
1979 val |= lsi_reg_readb(s, addr + 2) << 16;
1980 val |= lsi_reg_readb(s, addr + 3) << 24;
1981 return val;
1982 }
1983
1984 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1985 {
1986 LSIState *s = opaque;
1987 lsi_reg_writeb(s, addr & 0xff, val);
1988 }
1989
1990 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1991 {
1992 LSIState *s = opaque;
1993 addr &= 0xff;
1994 lsi_reg_writeb(s, addr, val & 0xff);
1995 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1996 }
1997
1998 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1999 {
2000 LSIState *s = opaque;
2001 addr &= 0xff;
2002 lsi_reg_writeb(s, addr, val & 0xff);
2003 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
2004 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
2005 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
2006 }
2007
2008 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
2009 pcibus_t addr, pcibus_t size, int type)
2010 {
2011 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2012
2013 DPRINTF("Mapping IO at %08"FMT_PCIBUS"\n", addr);
2014
2015 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
2016 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
2017 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
2018 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
2019 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
2020 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
2021 }
2022
2023 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
2024 pcibus_t addr, pcibus_t size, int type)
2025 {
2026 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2027
2028 DPRINTF("Mapping ram at %08"FMT_PCIBUS"\n", addr);
2029 s->script_ram_base = addr;
2030 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
2031 }
2032
2033 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
2034 pcibus_t addr, pcibus_t size, int type)
2035 {
2036 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2037
2038 DPRINTF("Mapping registers at %08"FMT_PCIBUS"\n", addr);
2039 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
2040 }
2041
2042 static void lsi_scsi_reset(DeviceState *dev)
2043 {
2044 LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
2045
2046 lsi_soft_reset(s);
2047 }
2048
2049 static void lsi_pre_save(void *opaque)
2050 {
2051 LSIState *s = opaque;
2052
2053 if (s->current) {
2054 assert(s->current->dma_buf == NULL);
2055 assert(s->current->dma_len == 0);
2056 }
2057 assert(QTAILQ_EMPTY(&s->queue));
2058 }
2059
2060 static const VMStateDescription vmstate_lsi_scsi = {
2061 .name = "lsiscsi",
2062 .version_id = 0,
2063 .minimum_version_id = 0,
2064 .minimum_version_id_old = 0,
2065 .pre_save = lsi_pre_save,
2066 .fields = (VMStateField []) {
2067 VMSTATE_PCI_DEVICE(dev, LSIState),
2068
2069 VMSTATE_INT32(carry, LSIState),
2070 VMSTATE_INT32(sense, LSIState),
2071 VMSTATE_INT32(msg_action, LSIState),
2072 VMSTATE_INT32(msg_len, LSIState),
2073 VMSTATE_BUFFER(msg, LSIState),
2074 VMSTATE_INT32(waiting, LSIState),
2075
2076 VMSTATE_UINT32(dsa, LSIState),
2077 VMSTATE_UINT32(temp, LSIState),
2078 VMSTATE_UINT32(dnad, LSIState),
2079 VMSTATE_UINT32(dbc, LSIState),
2080 VMSTATE_UINT8(istat0, LSIState),
2081 VMSTATE_UINT8(istat1, LSIState),
2082 VMSTATE_UINT8(dcmd, LSIState),
2083 VMSTATE_UINT8(dstat, LSIState),
2084 VMSTATE_UINT8(dien, LSIState),
2085 VMSTATE_UINT8(sist0, LSIState),
2086 VMSTATE_UINT8(sist1, LSIState),
2087 VMSTATE_UINT8(sien0, LSIState),
2088 VMSTATE_UINT8(sien1, LSIState),
2089 VMSTATE_UINT8(mbox0, LSIState),
2090 VMSTATE_UINT8(mbox1, LSIState),
2091 VMSTATE_UINT8(dfifo, LSIState),
2092 VMSTATE_UINT8(ctest2, LSIState),
2093 VMSTATE_UINT8(ctest3, LSIState),
2094 VMSTATE_UINT8(ctest4, LSIState),
2095 VMSTATE_UINT8(ctest5, LSIState),
2096 VMSTATE_UINT8(ccntl0, LSIState),
2097 VMSTATE_UINT8(ccntl1, LSIState),
2098 VMSTATE_UINT32(dsp, LSIState),
2099 VMSTATE_UINT32(dsps, LSIState),
2100 VMSTATE_UINT8(dmode, LSIState),
2101 VMSTATE_UINT8(dcntl, LSIState),
2102 VMSTATE_UINT8(scntl0, LSIState),
2103 VMSTATE_UINT8(scntl1, LSIState),
2104 VMSTATE_UINT8(scntl2, LSIState),
2105 VMSTATE_UINT8(scntl3, LSIState),
2106 VMSTATE_UINT8(sstat0, LSIState),
2107 VMSTATE_UINT8(sstat1, LSIState),
2108 VMSTATE_UINT8(scid, LSIState),
2109 VMSTATE_UINT8(sxfer, LSIState),
2110 VMSTATE_UINT8(socl, LSIState),
2111 VMSTATE_UINT8(sdid, LSIState),
2112 VMSTATE_UINT8(ssid, LSIState),
2113 VMSTATE_UINT8(sfbr, LSIState),
2114 VMSTATE_UINT8(stest1, LSIState),
2115 VMSTATE_UINT8(stest2, LSIState),
2116 VMSTATE_UINT8(stest3, LSIState),
2117 VMSTATE_UINT8(sidl, LSIState),
2118 VMSTATE_UINT8(stime0, LSIState),
2119 VMSTATE_UINT8(respid0, LSIState),
2120 VMSTATE_UINT8(respid1, LSIState),
2121 VMSTATE_UINT32(mmrs, LSIState),
2122 VMSTATE_UINT32(mmws, LSIState),
2123 VMSTATE_UINT32(sfs, LSIState),
2124 VMSTATE_UINT32(drs, LSIState),
2125 VMSTATE_UINT32(sbms, LSIState),
2126 VMSTATE_UINT32(dbms, LSIState),
2127 VMSTATE_UINT32(dnad64, LSIState),
2128 VMSTATE_UINT32(pmjad1, LSIState),
2129 VMSTATE_UINT32(pmjad2, LSIState),
2130 VMSTATE_UINT32(rbc, LSIState),
2131 VMSTATE_UINT32(ua, LSIState),
2132 VMSTATE_UINT32(ia, LSIState),
2133 VMSTATE_UINT32(sbc, LSIState),
2134 VMSTATE_UINT32(csbc, LSIState),
2135 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2136 VMSTATE_UINT8(sbr, LSIState),
2137
2138 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2139 VMSTATE_END_OF_LIST()
2140 }
2141 };
2142
2143 static int lsi_scsi_uninit(PCIDevice *d)
2144 {
2145 LSIState *s = DO_UPCAST(LSIState, dev, d);
2146
2147 cpu_unregister_io_memory(s->mmio_io_addr);
2148 cpu_unregister_io_memory(s->ram_io_addr);
2149
2150 return 0;
2151 }
2152
2153 static int lsi_scsi_init(PCIDevice *dev)
2154 {
2155 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2156 uint8_t *pci_conf;
2157
2158 pci_conf = s->dev.config;
2159
2160 /* PCI Vendor ID (word) */
2161 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2162 /* PCI device ID (word) */
2163 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2164 /* PCI base class code */
2165 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2166 /* PCI subsystem ID */
2167 pci_conf[PCI_SUBSYSTEM_ID] = 0x00;
2168 pci_conf[PCI_SUBSYSTEM_ID + 1] = 0x10;
2169 /* PCI latency timer = 255 */
2170 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2171 /* TODO: RST# value should be 0 */
2172 /* Interrupt pin 1 */
2173 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2174
2175 s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2176 lsi_mmio_writefn, s);
2177 s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2178 lsi_ram_writefn, s);
2179
2180 pci_register_bar(&s->dev, 0, 256,
2181 PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2182 pci_register_bar(&s->dev, 1, 0x400,
2183 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
2184 pci_register_bar(&s->dev, 2, 0x2000,
2185 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2186 QTAILQ_INIT(&s->queue);
2187
2188 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2189 if (!dev->qdev.hotplugged) {
2190 return scsi_bus_legacy_handle_cmdline(&s->bus);
2191 }
2192 return 0;
2193 }
2194
2195 static PCIDeviceInfo lsi_info = {
2196 .qdev.name = "lsi53c895a",
2197 .qdev.alias = "lsi",
2198 .qdev.size = sizeof(LSIState),
2199 .qdev.reset = lsi_scsi_reset,
2200 .qdev.vmsd = &vmstate_lsi_scsi,
2201 .init = lsi_scsi_init,
2202 .exit = lsi_scsi_uninit,
2203 };
2204
2205 static void lsi53c895a_register_devices(void)
2206 {
2207 pci_qdev_register(&lsi_info);
2208 }
2209
2210 device_init(lsi53c895a_register_devices);
QEmu