?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
scsi: scsi_bus_legacy_handle_cmdline() can fail, fix callers
[qemu.git] / hw / lsi53c895a.c
blob1bb1caf478a358eead6ffe061ba49d950c7d3a76
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licenced under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h>
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18 #include "block_int.h"
19
20 //#define DEBUG_LSI
21 //#define DEBUG_LSI_REG
22
23 #ifdef DEBUG_LSI
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
28 #else
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
32 #endif
33
34 #define LSI_MAX_DEVS 7
35
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
41
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
50
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
59
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
68
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
72
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
81
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
90
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
95
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
104
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
112
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
121
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
128
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
137
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
144
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
150
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
156
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
159
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
161
162 #define PHASE_DO 0
163 #define PHASE_DI 1
164 #define PHASE_CMD 2
165 #define PHASE_ST 3
166 #define PHASE_MO 6
167 #define PHASE_MI 7
168 #define PHASE_MASK 7
169
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
172
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
175
176 typedef struct lsi_request {
177 uint32_t tag;
178 uint32_t dma_len;
179 uint8_t *dma_buf;
180 uint32_t pending;
181 int out;
182 QTAILQ_ENTRY(lsi_request) next;
183 } lsi_request;
184
185 typedef struct {
186 PCIDevice dev;
187 int mmio_io_addr;
188 int ram_io_addr;
189 uint32_t script_ram_base;
190
191 int carry; /* ??? Should this be an a visible register somewhere? */
192 int sense;
193 /* Action to take at the end of a MSG IN phase.
194 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
195 int msg_action;
196 int msg_len;
197 uint8_t msg[LSI_MAX_MSGIN_LEN];
198 /* 0 if SCRIPTS are running or stopped.
199 * 1 if a Wait Reselect instruction has been issued.
200 * 2 if processing DMA from lsi_execute_script.
201 * 3 if a DMA operation is in progress. */
202 int waiting;
203 SCSIBus bus;
204 int current_lun;
205 /* The tag is a combination of the device ID and the SCSI tag. */
206 uint32_t select_tag;
207 int command_complete;
208 QTAILQ_HEAD(, lsi_request) queue;
209 lsi_request *current;
210
211 uint32_t dsa;
212 uint32_t temp;
213 uint32_t dnad;
214 uint32_t dbc;
215 uint8_t istat0;
216 uint8_t istat1;
217 uint8_t dcmd;
218 uint8_t dstat;
219 uint8_t dien;
220 uint8_t sist0;
221 uint8_t sist1;
222 uint8_t sien0;
223 uint8_t sien1;
224 uint8_t mbox0;
225 uint8_t mbox1;
226 uint8_t dfifo;
227 uint8_t ctest2;
228 uint8_t ctest3;
229 uint8_t ctest4;
230 uint8_t ctest5;
231 uint8_t ccntl0;
232 uint8_t ccntl1;
233 uint32_t dsp;
234 uint32_t dsps;
235 uint8_t dmode;
236 uint8_t dcntl;
237 uint8_t scntl0;
238 uint8_t scntl1;
239 uint8_t scntl2;
240 uint8_t scntl3;
241 uint8_t sstat0;
242 uint8_t sstat1;
243 uint8_t scid;
244 uint8_t sxfer;
245 uint8_t socl;
246 uint8_t sdid;
247 uint8_t ssid;
248 uint8_t sfbr;
249 uint8_t stest1;
250 uint8_t stest2;
251 uint8_t stest3;
252 uint8_t sidl;
253 uint8_t stime0;
254 uint8_t respid0;
255 uint8_t respid1;
256 uint32_t mmrs;
257 uint32_t mmws;
258 uint32_t sfs;
259 uint32_t drs;
260 uint32_t sbms;
261 uint32_t dbms;
262 uint32_t dnad64;
263 uint32_t pmjad1;
264 uint32_t pmjad2;
265 uint32_t rbc;
266 uint32_t ua;
267 uint32_t ia;
268 uint32_t sbc;
269 uint32_t csbc;
270 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
271 uint8_t sbr;
272
273 /* Script ram is stored as 32-bit words in host byteorder. */
274 uint32_t script_ram[2048];
275 } LSIState;
276
277 static inline int lsi_irq_on_rsl(LSIState *s)
278 {
279 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
280 }
281
282 static void lsi_soft_reset(LSIState *s)
283 {
284 lsi_request *p;
285
286 DPRINTF("Reset\n");
287 s->carry = 0;
288
289 s->msg_action = 0;
290 s->msg_len = 0;
291 s->waiting = 0;
292 s->dsa = 0;
293 s->dnad = 0;
294 s->dbc = 0;
295 s->temp = 0;
296 memset(s->scratch, 0, sizeof(s->scratch));
297 s->istat0 = 0;
298 s->istat1 = 0;
299 s->dcmd = 0x40;
300 s->dstat = LSI_DSTAT_DFE;
301 s->dien = 0;
302 s->sist0 = 0;
303 s->sist1 = 0;
304 s->sien0 = 0;
305 s->sien1 = 0;
306 s->mbox0 = 0;
307 s->mbox1 = 0;
308 s->dfifo = 0;
309 s->ctest2 = LSI_CTEST2_DACK;
310 s->ctest3 = 0;
311 s->ctest4 = 0;
312 s->ctest5 = 0;
313 s->ccntl0 = 0;
314 s->ccntl1 = 0;
315 s->dsp = 0;
316 s->dsps = 0;
317 s->dmode = 0;
318 s->dcntl = 0;
319 s->scntl0 = 0xc0;
320 s->scntl1 = 0;
321 s->scntl2 = 0;
322 s->scntl3 = 0;
323 s->sstat0 = 0;
324 s->sstat1 = 0;
325 s->scid = 7;
326 s->sxfer = 0;
327 s->socl = 0;
328 s->sdid = 0;
329 s->ssid = 0;
330 s->stest1 = 0;
331 s->stest2 = 0;
332 s->stest3 = 0;
333 s->sidl = 0;
334 s->stime0 = 0;
335 s->respid0 = 0x80;
336 s->respid1 = 0;
337 s->mmrs = 0;
338 s->mmws = 0;
339 s->sfs = 0;
340 s->drs = 0;
341 s->sbms = 0;
342 s->dbms = 0;
343 s->dnad64 = 0;
344 s->pmjad1 = 0;
345 s->pmjad2 = 0;
346 s->rbc = 0;
347 s->ua = 0;
348 s->ia = 0;
349 s->sbc = 0;
350 s->csbc = 0;
351 s->sbr = 0;
352 while (!QTAILQ_EMPTY(&s->queue)) {
353 p = QTAILQ_FIRST(&s->queue);
354 QTAILQ_REMOVE(&s->queue, p, next);
355 qemu_free(p);
356 }
357 if (s->current) {
358 qemu_free(s->current);
359 s->current = NULL;
360 }
361 }
362
363 static int lsi_dma_40bit(LSIState *s)
364 {
365 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
366 return 1;
367 return 0;
368 }
369
370 static int lsi_dma_ti64bit(LSIState *s)
371 {
372 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
373 return 1;
374 return 0;
375 }
376
377 static int lsi_dma_64bit(LSIState *s)
378 {
379 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
380 return 1;
381 return 0;
382 }
383
384 static uint8_t lsi_reg_readb(LSIState *s, int offset);
385 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
386 static void lsi_execute_script(LSIState *s);
387 static void lsi_reselect(LSIState *s, lsi_request *p);
388
389 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
390 {
391 uint32_t buf;
392
393 /* Optimize reading from SCRIPTS RAM. */
394 if ((addr & 0xffffe000) == s->script_ram_base) {
395 return s->script_ram[(addr & 0x1fff) >> 2];
396 }
397 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
398 return cpu_to_le32(buf);
399 }
400
401 static void lsi_stop_script(LSIState *s)
402 {
403 s->istat1 &= ~LSI_ISTAT1_SRUN;
404 }
405
406 static void lsi_update_irq(LSIState *s)
407 {
408 int level;
409 static int last_level;
410 lsi_request *p;
411
412 /* It's unclear whether the DIP/SIP bits should be cleared when the
413 Interrupt Status Registers are cleared or when istat0 is read.
414 We currently do the formwer, which seems to work. */
415 level = 0;
416 if (s->dstat) {
417 if (s->dstat & s->dien)
418 level = 1;
419 s->istat0 |= LSI_ISTAT0_DIP;
420 } else {
421 s->istat0 &= ~LSI_ISTAT0_DIP;
422 }
423
424 if (s->sist0 || s->sist1) {
425 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
426 level = 1;
427 s->istat0 |= LSI_ISTAT0_SIP;
428 } else {
429 s->istat0 &= ~LSI_ISTAT0_SIP;
430 }
431 if (s->istat0 & LSI_ISTAT0_INTF)
432 level = 1;
433
434 if (level != last_level) {
435 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
436 level, s->dstat, s->sist1, s->sist0);
437 last_level = level;
438 }
439 qemu_set_irq(s->dev.irq[0], level);
440
441 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
442 DPRINTF("Handled IRQs & disconnected, looking for pending "
443 "processes\n");
444 QTAILQ_FOREACH(p, &s->queue, next) {
445 if (p->pending) {
446 lsi_reselect(s, p);
447 break;
448 }
449 }
450 }
451 }
452
453 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
454 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
455 {
456 uint32_t mask0;
457 uint32_t mask1;
458
459 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
460 stat1, stat0, s->sist1, s->sist0);
461 s->sist0 |= stat0;
462 s->sist1 |= stat1;
463 /* Stop processor on fatal or unmasked interrupt. As a special hack
464 we don't stop processing when raising STO. Instead continue
465 execution and stop at the next insn that accesses the SCSI bus. */
466 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
467 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
468 mask1 &= ~LSI_SIST1_STO;
469 if (s->sist0 & mask0 || s->sist1 & mask1) {
470 lsi_stop_script(s);
471 }
472 lsi_update_irq(s);
473 }
474
475 /* Stop SCRIPTS execution and raise a DMA interrupt. */
476 static void lsi_script_dma_interrupt(LSIState *s, int stat)
477 {
478 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
479 s->dstat |= stat;
480 lsi_update_irq(s);
481 lsi_stop_script(s);
482 }
483
484 static inline void lsi_set_phase(LSIState *s, int phase)
485 {
486 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
487 }
488
489 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
490 {
491 /* Trigger a phase mismatch. */
492 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
493 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
494 s->dsp = out ? s->pmjad1 : s->pmjad2;
495 } else {
496 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
497 }
498 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
499 } else {
500 DPRINTF("Phase mismatch interrupt\n");
501 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
502 lsi_stop_script(s);
503 }
504 lsi_set_phase(s, new_phase);
505 }
506
507
508 /* Resume SCRIPTS execution after a DMA operation. */
509 static void lsi_resume_script(LSIState *s)
510 {
511 if (s->waiting != 2) {
512 s->waiting = 0;
513 lsi_execute_script(s);
514 } else {
515 s->waiting = 0;
516 }
517 }
518
519 static void lsi_disconnect(LSIState *s)
520 {
521 s->scntl1 &= ~LSI_SCNTL1_CON;
522 s->sstat1 &= ~PHASE_MASK;
523 }
524
525 static void lsi_bad_selection(LSIState *s, uint32_t id)
526 {
527 DPRINTF("Selected absent target %d\n", id);
528 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
529 lsi_disconnect(s);
530 }
531
532 /* Initiate a SCSI layer data transfer. */
533 static void lsi_do_dma(LSIState *s, int out)
534 {
535 uint32_t count, id;
536 target_phys_addr_t addr;
537 SCSIDevice *dev;
538
539 assert(s->current);
540 if (!s->current->dma_len) {
541 /* Wait until data is available. */
542 DPRINTF("DMA no data available\n");
543 return;
544 }
545
546 id = (s->current->tag >> 8) & 0xf;
547 dev = s->bus.devs[id];
548 if (!dev) {
549 lsi_bad_selection(s, id);
550 return;
551 }
552
553 count = s->dbc;
554 if (count > s->current->dma_len)
555 count = s->current->dma_len;
556
557 addr = s->dnad;
558 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
559 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
560 addr |= ((uint64_t)s->dnad64 << 32);
561 else if (s->dbms)
562 addr |= ((uint64_t)s->dbms << 32);
563 else if (s->sbms)
564 addr |= ((uint64_t)s->sbms << 32);
565
566 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
567 s->csbc += count;
568 s->dnad += count;
569 s->dbc -= count;
570
571 if (s->current->dma_buf == NULL) {
572 s->current->dma_buf = dev->info->get_buf(dev, s->current->tag);
573 }
574
575 /* ??? Set SFBR to first data byte. */
576 if (out) {
577 cpu_physical_memory_read(addr, s->current->dma_buf, count);
578 } else {
579 cpu_physical_memory_write(addr, s->current->dma_buf, count);
580 }
581 s->current->dma_len -= count;
582 if (s->current->dma_len == 0) {
583 s->current->dma_buf = NULL;
584 if (out) {
585 /* Write the data. */
586 dev->info->write_data(dev, s->current->tag);
587 } else {
588 /* Request any remaining data. */
589 dev->info->read_data(dev, s->current->tag);
590 }
591 } else {
592 s->current->dma_buf += count;
593 lsi_resume_script(s);
594 }
595 }
596
597
598 /* Add a command to the queue. */
599 static void lsi_queue_command(LSIState *s)
600 {
601 lsi_request *p = s->current;
602
603 DPRINTF("Queueing tag=0x%x\n", s->current_tag);
604 assert(s->current != NULL);
605 assert(s->current->dma_len == 0);
606 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
607 s->current = NULL;
608
609 p->pending = 0;
610 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
611 }
612
613 /* Queue a byte for a MSG IN phase. */
614 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
615 {
616 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
617 BADF("MSG IN data too long\n");
618 } else {
619 DPRINTF("MSG IN 0x%02x\n", data);
620 s->msg[s->msg_len++] = data;
621 }
622 }
623
624 /* Perform reselection to continue a command. */
625 static void lsi_reselect(LSIState *s, lsi_request *p)
626 {
627 int id;
628
629 assert(s->current == NULL);
630 QTAILQ_REMOVE(&s->queue, p, next);
631 s->current = p;
632
633 id = (p->tag >> 8) & 0xf;
634 s->ssid = id | 0x80;
635 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
636 if (!(s->dcntl & LSI_DCNTL_COM)) {
637 s->sfbr = 1 << (id & 0x7);
638 }
639 DPRINTF("Reselected target %d\n", id);
640 s->scntl1 |= LSI_SCNTL1_CON;
641 lsi_set_phase(s, PHASE_MI);
642 s->msg_action = p->out ? 2 : 3;
643 s->current->dma_len = p->pending;
644 lsi_add_msg_byte(s, 0x80);
645 if (s->current->tag & LSI_TAG_VALID) {
646 lsi_add_msg_byte(s, 0x20);
647 lsi_add_msg_byte(s, p->tag & 0xff);
648 }
649
650 if (lsi_irq_on_rsl(s)) {
651 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
652 }
653 }
654
655 /* Record that data is available for a queued command. Returns zero if
656 the device was reselected, nonzero if the IO is deferred. */
657 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
658 {
659 lsi_request *p;
660
661 QTAILQ_FOREACH(p, &s->queue, next) {
662 if (p->tag == tag) {
663 if (p->pending) {
664 BADF("Multiple IO pending for tag %d\n", tag);
665 }
666 p->pending = arg;
667 /* Reselect if waiting for it, or if reselection triggers an IRQ
668 and the bus is free.
669 Since no interrupt stacking is implemented in the emulation, it
670 is also required that there are no pending interrupts waiting
671 for service from the device driver. */
672 if (s->waiting == 1 ||
673 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
674 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
675 /* Reselect device. */
676 lsi_reselect(s, p);
677 return 0;
678 } else {
679 DPRINTF("Queueing IO tag=0x%x\n", tag);
680 p->pending = arg;
681 return 1;
682 }
683 }
684 }
685 BADF("IO with unknown tag %d\n", tag);
686 return 1;
687 }
688
689 /* Callback to indicate that the SCSI layer has completed a transfer. */
690 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
691 uint32_t arg)
692 {
693 LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
694 int out;
695
696 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
697 if (reason == SCSI_REASON_DONE) {
698 DPRINTF("Command complete sense=%d\n", (int)arg);
699 s->sense = arg;
700 s->command_complete = 2;
701 if (s->waiting && s->dbc != 0) {
702 /* Raise phase mismatch for short transfers. */
703 lsi_bad_phase(s, out, PHASE_ST);
704 } else {
705 lsi_set_phase(s, PHASE_ST);
706 }
707
708 qemu_free(s->current);
709 s->current = NULL;
710
711 lsi_resume_script(s);
712 return;
713 }
714
715 if (s->waiting == 1 || !s->current || tag != s->current->tag ||
716 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
717 if (lsi_queue_tag(s, tag, arg))
718 return;
719 }
720
721 /* host adapter (re)connected */
722 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
723 s->current->dma_len = arg;
724 s->command_complete = 1;
725 if (!s->waiting)
726 return;
727 if (s->waiting == 1 || s->dbc == 0) {
728 lsi_resume_script(s);
729 } else {
730 lsi_do_dma(s, out);
731 }
732 }
733
734 static void lsi_do_command(LSIState *s)
735 {
736 SCSIDevice *dev;
737 uint8_t buf[16];
738 uint32_t id;
739 int n;
740
741 DPRINTF("Send command len=%d\n", s->dbc);
742 if (s->dbc > 16)
743 s->dbc = 16;
744 cpu_physical_memory_read(s->dnad, buf, s->dbc);
745 s->sfbr = buf[0];
746 s->command_complete = 0;
747
748 id = (s->select_tag >> 8) & 0xf;
749 dev = s->bus.devs[id];
750 if (!dev) {
751 lsi_bad_selection(s, id);
752 return;
753 }
754
755 assert(s->current == NULL);
756 s->current = qemu_mallocz(sizeof(lsi_request));
757 s->current->tag = s->select_tag;
758
759 n = dev->info->send_command(dev, s->current->tag, buf, s->current_lun);
760 if (n > 0) {
761 lsi_set_phase(s, PHASE_DI);
762 dev->info->read_data(dev, s->current->tag);
763 } else if (n < 0) {
764 lsi_set_phase(s, PHASE_DO);
765 dev->info->write_data(dev, s->current->tag);
766 }
767
768 if (!s->command_complete) {
769 if (n) {
770 /* Command did not complete immediately so disconnect. */
771 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
772 lsi_add_msg_byte(s, 4); /* DISCONNECT */
773 /* wait data */
774 lsi_set_phase(s, PHASE_MI);
775 s->msg_action = 1;
776 lsi_queue_command(s);
777 } else {
778 /* wait command complete */
779 lsi_set_phase(s, PHASE_DI);
780 }
781 }
782 }
783
784 static void lsi_do_status(LSIState *s)
785 {
786 uint8_t sense;
787 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
788 if (s->dbc != 1)
789 BADF("Bad Status move\n");
790 s->dbc = 1;
791 sense = s->sense;
792 s->sfbr = sense;
793 cpu_physical_memory_write(s->dnad, &sense, 1);
794 lsi_set_phase(s, PHASE_MI);
795 s->msg_action = 1;
796 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
797 }
798
799 static void lsi_do_msgin(LSIState *s)
800 {
801 int len;
802 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
803 s->sfbr = s->msg[0];
804 len = s->msg_len;
805 if (len > s->dbc)
806 len = s->dbc;
807 cpu_physical_memory_write(s->dnad, s->msg, len);
808 /* Linux drivers rely on the last byte being in the SIDL. */
809 s->sidl = s->msg[len - 1];
810 s->msg_len -= len;
811 if (s->msg_len) {
812 memmove(s->msg, s->msg + len, s->msg_len);
813 } else {
814 /* ??? Check if ATN (not yet implemented) is asserted and maybe
815 switch to PHASE_MO. */
816 switch (s->msg_action) {
817 case 0:
818 lsi_set_phase(s, PHASE_CMD);
819 break;
820 case 1:
821 lsi_disconnect(s);
822 break;
823 case 2:
824 lsi_set_phase(s, PHASE_DO);
825 break;
826 case 3:
827 lsi_set_phase(s, PHASE_DI);
828 break;
829 default:
830 abort();
831 }
832 }
833 }
834
835 /* Read the next byte during a MSGOUT phase. */
836 static uint8_t lsi_get_msgbyte(LSIState *s)
837 {
838 uint8_t data;
839 cpu_physical_memory_read(s->dnad, &data, 1);
840 s->dnad++;
841 s->dbc--;
842 return data;
843 }
844
845 static void lsi_do_msgout(LSIState *s)
846 {
847 uint8_t msg;
848 int len;
849
850 DPRINTF("MSG out len=%d\n", s->dbc);
851 while (s->dbc) {
852 msg = lsi_get_msgbyte(s);
853 s->sfbr = msg;
854
855 switch (msg) {
856 case 0x04:
857 DPRINTF("MSG: Disconnect\n");
858 lsi_disconnect(s);
859 break;
860 case 0x08:
861 DPRINTF("MSG: No Operation\n");
862 lsi_set_phase(s, PHASE_CMD);
863 break;
864 case 0x01:
865 len = lsi_get_msgbyte(s);
866 msg = lsi_get_msgbyte(s);
867 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
868 switch (msg) {
869 case 1:
870 DPRINTF("SDTR (ignored)\n");
871 s->dbc -= 2;
872 break;
873 case 3:
874 DPRINTF("WDTR (ignored)\n");
875 s->dbc -= 1;
876 break;
877 default:
878 goto bad;
879 }
880 break;
881 case 0x20: /* SIMPLE queue */
882 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
883 DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
884 break;
885 case 0x21: /* HEAD of queue */
886 BADF("HEAD queue not implemented\n");
887 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
888 break;
889 case 0x22: /* ORDERED queue */
890 BADF("ORDERED queue not implemented\n");
891 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
892 break;
893 default:
894 if ((msg & 0x80) == 0) {
895 goto bad;
896 }
897 s->current_lun = msg & 7;
898 DPRINTF("Select LUN %d\n", s->current_lun);
899 lsi_set_phase(s, PHASE_CMD);
900 break;
901 }
902 }
903 return;
904 bad:
905 BADF("Unimplemented message 0x%02x\n", msg);
906 lsi_set_phase(s, PHASE_MI);
907 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
908 s->msg_action = 0;
909 }
910
911 /* Sign extend a 24-bit value. */
912 static inline int32_t sxt24(int32_t n)
913 {
914 return (n << 8) >> 8;
915 }
916
917 #define LSI_BUF_SIZE 4096
918 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
919 {
920 int n;
921 uint8_t buf[LSI_BUF_SIZE];
922
923 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
924 while (count) {
925 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
926 cpu_physical_memory_read(src, buf, n);
927 cpu_physical_memory_write(dest, buf, n);
928 src += n;
929 dest += n;
930 count -= n;
931 }
932 }
933
934 static void lsi_wait_reselect(LSIState *s)
935 {
936 lsi_request *p;
937
938 DPRINTF("Wait Reselect\n");
939
940 QTAILQ_FOREACH(p, &s->queue, next) {
941 if (p->pending) {
942 lsi_reselect(s, p);
943 break;
944 }
945 }
946 if (s->current == NULL) {
947 s->waiting = 1;
948 }
949 }
950
951 static void lsi_execute_script(LSIState *s)
952 {
953 uint32_t insn;
954 uint32_t addr, addr_high;
955 int opcode;
956 int insn_processed = 0;
957
958 s->istat1 |= LSI_ISTAT1_SRUN;
959 again:
960 insn_processed++;
961 insn = read_dword(s, s->dsp);
962 if (!insn) {
963 /* If we receive an empty opcode increment the DSP by 4 bytes
964 instead of 8 and execute the next opcode at that location */
965 s->dsp += 4;
966 goto again;
967 }
968 addr = read_dword(s, s->dsp + 4);
969 addr_high = 0;
970 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
971 s->dsps = addr;
972 s->dcmd = insn >> 24;
973 s->dsp += 8;
974 switch (insn >> 30) {
975 case 0: /* Block move. */
976 if (s->sist1 & LSI_SIST1_STO) {
977 DPRINTF("Delayed select timeout\n");
978 lsi_stop_script(s);
979 break;
980 }
981 s->dbc = insn & 0xffffff;
982 s->rbc = s->dbc;
983 /* ??? Set ESA. */
984 s->ia = s->dsp - 8;
985 if (insn & (1 << 29)) {
986 /* Indirect addressing. */
987 addr = read_dword(s, addr);
988 } else if (insn & (1 << 28)) {
989 uint32_t buf[2];
990 int32_t offset;
991 /* Table indirect addressing. */
992
993 /* 32-bit Table indirect */
994 offset = sxt24(addr);
995 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
996 /* byte count is stored in bits 0:23 only */
997 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
998 s->rbc = s->dbc;
999 addr = cpu_to_le32(buf[1]);
1000
1001 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1002 * table, bits [31:24] */
1003 if (lsi_dma_40bit(s))
1004 addr_high = cpu_to_le32(buf[0]) >> 24;
1005 else if (lsi_dma_ti64bit(s)) {
1006 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1007 switch (selector) {
1008 case 0 ... 0x0f:
1009 /* offset index into scratch registers since
1010 * TI64 mode can use registers C to R */
1011 addr_high = s->scratch[2 + selector];
1012 break;
1013 case 0x10:
1014 addr_high = s->mmrs;
1015 break;
1016 case 0x11:
1017 addr_high = s->mmws;
1018 break;
1019 case 0x12:
1020 addr_high = s->sfs;
1021 break;
1022 case 0x13:
1023 addr_high = s->drs;
1024 break;
1025 case 0x14:
1026 addr_high = s->sbms;
1027 break;
1028 case 0x15:
1029 addr_high = s->dbms;
1030 break;
1031 default:
1032 BADF("Illegal selector specified (0x%x > 0x15)"
1033 " for 64-bit DMA block move", selector);
1034 break;
1035 }
1036 }
1037 } else if (lsi_dma_64bit(s)) {
1038 /* fetch a 3rd dword if 64-bit direct move is enabled and
1039 only if we're not doing table indirect or indirect addressing */
1040 s->dbms = read_dword(s, s->dsp);
1041 s->dsp += 4;
1042 s->ia = s->dsp - 12;
1043 }
1044 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1045 DPRINTF("Wrong phase got %d expected %d\n",
1046 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1047 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1048 break;
1049 }
1050 s->dnad = addr;
1051 s->dnad64 = addr_high;
1052 switch (s->sstat1 & 0x7) {
1053 case PHASE_DO:
1054 s->waiting = 2;
1055 lsi_do_dma(s, 1);
1056 if (s->waiting)
1057 s->waiting = 3;
1058 break;
1059 case PHASE_DI:
1060 s->waiting = 2;
1061 lsi_do_dma(s, 0);
1062 if (s->waiting)
1063 s->waiting = 3;
1064 break;
1065 case PHASE_CMD:
1066 lsi_do_command(s);
1067 break;
1068 case PHASE_ST:
1069 lsi_do_status(s);
1070 break;
1071 case PHASE_MO:
1072 lsi_do_msgout(s);
1073 break;
1074 case PHASE_MI:
1075 lsi_do_msgin(s);
1076 break;
1077 default:
1078 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1079 exit(1);
1080 }
1081 s->dfifo = s->dbc & 0xff;
1082 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1083 s->sbc = s->dbc;
1084 s->rbc -= s->dbc;
1085 s->ua = addr + s->dbc;
1086 break;
1087
1088 case 1: /* IO or Read/Write instruction. */
1089 opcode = (insn >> 27) & 7;
1090 if (opcode < 5) {
1091 uint32_t id;
1092
1093 if (insn & (1 << 25)) {
1094 id = read_dword(s, s->dsa + sxt24(insn));
1095 } else {
1096 id = insn;
1097 }
1098 id = (id >> 16) & 0xf;
1099 if (insn & (1 << 26)) {
1100 addr = s->dsp + sxt24(addr);
1101 }
1102 s->dnad = addr;
1103 switch (opcode) {
1104 case 0: /* Select */
1105 s->sdid = id;
1106 if (s->scntl1 & LSI_SCNTL1_CON) {
1107 DPRINTF("Already reselected, jumping to alternative address\n");
1108 s->dsp = s->dnad;
1109 break;
1110 }
1111 s->sstat0 |= LSI_SSTAT0_WOA;
1112 s->scntl1 &= ~LSI_SCNTL1_IARB;
1113 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1114 lsi_bad_selection(s, id);
1115 break;
1116 }
1117 DPRINTF("Selected target %d%s\n",
1118 id, insn & (1 << 3) ? " ATN" : "");
1119 /* ??? Linux drivers compain when this is set. Maybe
1120 it only applies in low-level mode (unimplemented).
1121 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1122 s->select_tag = id << 8;
1123 s->scntl1 |= LSI_SCNTL1_CON;
1124 if (insn & (1 << 3)) {
1125 s->socl |= LSI_SOCL_ATN;
1126 }
1127 lsi_set_phase(s, PHASE_MO);
1128 break;
1129 case 1: /* Disconnect */
1130 DPRINTF("Wait Disconnect\n");
1131 s->scntl1 &= ~LSI_SCNTL1_CON;
1132 break;
1133 case 2: /* Wait Reselect */
1134 if (!lsi_irq_on_rsl(s)) {
1135 lsi_wait_reselect(s);
1136 }
1137 break;
1138 case 3: /* Set */
1139 DPRINTF("Set%s%s%s%s\n",
1140 insn & (1 << 3) ? " ATN" : "",
1141 insn & (1 << 6) ? " ACK" : "",
1142 insn & (1 << 9) ? " TM" : "",
1143 insn & (1 << 10) ? " CC" : "");
1144 if (insn & (1 << 3)) {
1145 s->socl |= LSI_SOCL_ATN;
1146 lsi_set_phase(s, PHASE_MO);
1147 }
1148 if (insn & (1 << 9)) {
1149 BADF("Target mode not implemented\n");
1150 exit(1);
1151 }
1152 if (insn & (1 << 10))
1153 s->carry = 1;
1154 break;
1155 case 4: /* Clear */
1156 DPRINTF("Clear%s%s%s%s\n",
1157 insn & (1 << 3) ? " ATN" : "",
1158 insn & (1 << 6) ? " ACK" : "",
1159 insn & (1 << 9) ? " TM" : "",
1160 insn & (1 << 10) ? " CC" : "");
1161 if (insn & (1 << 3)) {
1162 s->socl &= ~LSI_SOCL_ATN;
1163 }
1164 if (insn & (1 << 10))
1165 s->carry = 0;
1166 break;
1167 }
1168 } else {
1169 uint8_t op0;
1170 uint8_t op1;
1171 uint8_t data8;
1172 int reg;
1173 int operator;
1174 #ifdef DEBUG_LSI
1175 static const char *opcode_names[3] =
1176 {"Write", "Read", "Read-Modify-Write"};
1177 static const char *operator_names[8] =
1178 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1179 #endif
1180
1181 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1182 data8 = (insn >> 8) & 0xff;
1183 opcode = (insn >> 27) & 7;
1184 operator = (insn >> 24) & 7;
1185 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1186 opcode_names[opcode - 5], reg,
1187 operator_names[operator], data8, s->sfbr,
1188 (insn & (1 << 23)) ? " SFBR" : "");
1189 op0 = op1 = 0;
1190 switch (opcode) {
1191 case 5: /* From SFBR */
1192 op0 = s->sfbr;
1193 op1 = data8;
1194 break;
1195 case 6: /* To SFBR */
1196 if (operator)
1197 op0 = lsi_reg_readb(s, reg);
1198 op1 = data8;
1199 break;
1200 case 7: /* Read-modify-write */
1201 if (operator)
1202 op0 = lsi_reg_readb(s, reg);
1203 if (insn & (1 << 23)) {
1204 op1 = s->sfbr;
1205 } else {
1206 op1 = data8;
1207 }
1208 break;
1209 }
1210
1211 switch (operator) {
1212 case 0: /* move */
1213 op0 = op1;
1214 break;
1215 case 1: /* Shift left */
1216 op1 = op0 >> 7;
1217 op0 = (op0 << 1) | s->carry;
1218 s->carry = op1;
1219 break;
1220 case 2: /* OR */
1221 op0 |= op1;
1222 break;
1223 case 3: /* XOR */
1224 op0 ^= op1;
1225 break;
1226 case 4: /* AND */
1227 op0 &= op1;
1228 break;
1229 case 5: /* SHR */
1230 op1 = op0 & 1;
1231 op0 = (op0 >> 1) | (s->carry << 7);
1232 s->carry = op1;
1233 break;
1234 case 6: /* ADD */
1235 op0 += op1;
1236 s->carry = op0 < op1;
1237 break;
1238 case 7: /* ADC */
1239 op0 += op1 + s->carry;
1240 if (s->carry)
1241 s->carry = op0 <= op1;
1242 else
1243 s->carry = op0 < op1;
1244 break;
1245 }
1246
1247 switch (opcode) {
1248 case 5: /* From SFBR */
1249 case 7: /* Read-modify-write */
1250 lsi_reg_writeb(s, reg, op0);
1251 break;
1252 case 6: /* To SFBR */
1253 s->sfbr = op0;
1254 break;
1255 }
1256 }
1257 break;
1258
1259 case 2: /* Transfer Control. */
1260 {
1261 int cond;
1262 int jmp;
1263
1264 if ((insn & 0x002e0000) == 0) {
1265 DPRINTF("NOP\n");
1266 break;
1267 }
1268 if (s->sist1 & LSI_SIST1_STO) {
1269 DPRINTF("Delayed select timeout\n");
1270 lsi_stop_script(s);
1271 break;
1272 }
1273 cond = jmp = (insn & (1 << 19)) != 0;
1274 if (cond == jmp && (insn & (1 << 21))) {
1275 DPRINTF("Compare carry %d\n", s->carry == jmp);
1276 cond = s->carry != 0;
1277 }
1278 if (cond == jmp && (insn & (1 << 17))) {
1279 DPRINTF("Compare phase %d %c= %d\n",
1280 (s->sstat1 & PHASE_MASK),
1281 jmp ? '=' : '!',
1282 ((insn >> 24) & 7));
1283 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1284 }
1285 if (cond == jmp && (insn & (1 << 18))) {
1286 uint8_t mask;
1287
1288 mask = (~insn >> 8) & 0xff;
1289 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1290 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1291 cond = (s->sfbr & mask) == (insn & mask);
1292 }
1293 if (cond == jmp) {
1294 if (insn & (1 << 23)) {
1295 /* Relative address. */
1296 addr = s->dsp + sxt24(addr);
1297 }
1298 switch ((insn >> 27) & 7) {
1299 case 0: /* Jump */
1300 DPRINTF("Jump to 0x%08x\n", addr);
1301 s->dsp = addr;
1302 break;
1303 case 1: /* Call */
1304 DPRINTF("Call 0x%08x\n", addr);
1305 s->temp = s->dsp;
1306 s->dsp = addr;
1307 break;
1308 case 2: /* Return */
1309 DPRINTF("Return to 0x%08x\n", s->temp);
1310 s->dsp = s->temp;
1311 break;
1312 case 3: /* Interrupt */
1313 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1314 if ((insn & (1 << 20)) != 0) {
1315 s->istat0 |= LSI_ISTAT0_INTF;
1316 lsi_update_irq(s);
1317 } else {
1318 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1319 }
1320 break;
1321 default:
1322 DPRINTF("Illegal transfer control\n");
1323 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1324 break;
1325 }
1326 } else {
1327 DPRINTF("Control condition failed\n");
1328 }
1329 }
1330 break;
1331
1332 case 3:
1333 if ((insn & (1 << 29)) == 0) {
1334 /* Memory move. */
1335 uint32_t dest;
1336 /* ??? The docs imply the destination address is loaded into
1337 the TEMP register. However the Linux drivers rely on
1338 the value being presrved. */
1339 dest = read_dword(s, s->dsp);
1340 s->dsp += 4;
1341 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1342 } else {
1343 uint8_t data[7];
1344 int reg;
1345 int n;
1346 int i;
1347
1348 if (insn & (1 << 28)) {
1349 addr = s->dsa + sxt24(addr);
1350 }
1351 n = (insn & 7);
1352 reg = (insn >> 16) & 0xff;
1353 if (insn & (1 << 24)) {
1354 cpu_physical_memory_read(addr, data, n);
1355 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1356 addr, *(int *)data);
1357 for (i = 0; i < n; i++) {
1358 lsi_reg_writeb(s, reg + i, data[i]);
1359 }
1360 } else {
1361 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1362 for (i = 0; i < n; i++) {
1363 data[i] = lsi_reg_readb(s, reg + i);
1364 }
1365 cpu_physical_memory_write(addr, data, n);
1366 }
1367 }
1368 }
1369 if (insn_processed > 10000 && !s->waiting) {
1370 /* Some windows drivers make the device spin waiting for a memory
1371 location to change. If we have been executed a lot of code then
1372 assume this is the case and force an unexpected device disconnect.
1373 This is apparently sufficient to beat the drivers into submission.
1374 */
1375 if (!(s->sien0 & LSI_SIST0_UDC))
1376 fprintf(stderr, "inf. loop with UDC masked\n");
1377 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1378 lsi_disconnect(s);
1379 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1380 if (s->dcntl & LSI_DCNTL_SSM) {
1381 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1382 } else {
1383 goto again;
1384 }
1385 }
1386 DPRINTF("SCRIPTS execution stopped\n");
1387 }
1388
1389 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1390 {
1391 uint8_t tmp;
1392 #define CASE_GET_REG24(name, addr) \
1393 case addr: return s->name & 0xff; \
1394 case addr + 1: return (s->name >> 8) & 0xff; \
1395 case addr + 2: return (s->name >> 16) & 0xff;
1396
1397 #define CASE_GET_REG32(name, addr) \
1398 case addr: return s->name & 0xff; \
1399 case addr + 1: return (s->name >> 8) & 0xff; \
1400 case addr + 2: return (s->name >> 16) & 0xff; \
1401 case addr + 3: return (s->name >> 24) & 0xff;
1402
1403 #ifdef DEBUG_LSI_REG
1404 DPRINTF("Read reg %x\n", offset);
1405 #endif
1406 switch (offset) {
1407 case 0x00: /* SCNTL0 */
1408 return s->scntl0;
1409 case 0x01: /* SCNTL1 */
1410 return s->scntl1;
1411 case 0x02: /* SCNTL2 */
1412 return s->scntl2;
1413 case 0x03: /* SCNTL3 */
1414 return s->scntl3;
1415 case 0x04: /* SCID */
1416 return s->scid;
1417 case 0x05: /* SXFER */
1418 return s->sxfer;
1419 case 0x06: /* SDID */
1420 return s->sdid;
1421 case 0x07: /* GPREG0 */
1422 return 0x7f;
1423 case 0x08: /* Revision ID */
1424 return 0x00;
1425 case 0xa: /* SSID */
1426 return s->ssid;
1427 case 0xb: /* SBCL */
1428 /* ??? This is not correct. However it's (hopefully) only
1429 used for diagnostics, so should be ok. */
1430 return 0;
1431 case 0xc: /* DSTAT */
1432 tmp = s->dstat | 0x80;
1433 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1434 s->dstat = 0;
1435 lsi_update_irq(s);
1436 return tmp;
1437 case 0x0d: /* SSTAT0 */
1438 return s->sstat0;
1439 case 0x0e: /* SSTAT1 */
1440 return s->sstat1;
1441 case 0x0f: /* SSTAT2 */
1442 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1443 CASE_GET_REG32(dsa, 0x10)
1444 case 0x14: /* ISTAT0 */
1445 return s->istat0;
1446 case 0x15: /* ISTAT1 */
1447 return s->istat1;
1448 case 0x16: /* MBOX0 */
1449 return s->mbox0;
1450 case 0x17: /* MBOX1 */
1451 return s->mbox1;
1452 case 0x18: /* CTEST0 */
1453 return 0xff;
1454 case 0x19: /* CTEST1 */
1455 return 0;
1456 case 0x1a: /* CTEST2 */
1457 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1458 if (s->istat0 & LSI_ISTAT0_SIGP) {
1459 s->istat0 &= ~LSI_ISTAT0_SIGP;
1460 tmp |= LSI_CTEST2_SIGP;
1461 }
1462 return tmp;
1463 case 0x1b: /* CTEST3 */
1464 return s->ctest3;
1465 CASE_GET_REG32(temp, 0x1c)
1466 case 0x20: /* DFIFO */
1467 return 0;
1468 case 0x21: /* CTEST4 */
1469 return s->ctest4;
1470 case 0x22: /* CTEST5 */
1471 return s->ctest5;
1472 case 0x23: /* CTEST6 */
1473 return 0;
1474 CASE_GET_REG24(dbc, 0x24)
1475 case 0x27: /* DCMD */
1476 return s->dcmd;
1477 CASE_GET_REG32(dnad, 0x28)
1478 CASE_GET_REG32(dsp, 0x2c)
1479 CASE_GET_REG32(dsps, 0x30)
1480 CASE_GET_REG32(scratch[0], 0x34)
1481 case 0x38: /* DMODE */
1482 return s->dmode;
1483 case 0x39: /* DIEN */
1484 return s->dien;
1485 case 0x3a: /* SBR */
1486 return s->sbr;
1487 case 0x3b: /* DCNTL */
1488 return s->dcntl;
1489 case 0x40: /* SIEN0 */
1490 return s->sien0;
1491 case 0x41: /* SIEN1 */
1492 return s->sien1;
1493 case 0x42: /* SIST0 */
1494 tmp = s->sist0;
1495 s->sist0 = 0;
1496 lsi_update_irq(s);
1497 return tmp;
1498 case 0x43: /* SIST1 */
1499 tmp = s->sist1;
1500 s->sist1 = 0;
1501 lsi_update_irq(s);
1502 return tmp;
1503 case 0x46: /* MACNTL */
1504 return 0x0f;
1505 case 0x47: /* GPCNTL0 */
1506 return 0x0f;
1507 case 0x48: /* STIME0 */
1508 return s->stime0;
1509 case 0x4a: /* RESPID0 */
1510 return s->respid0;
1511 case 0x4b: /* RESPID1 */
1512 return s->respid1;
1513 case 0x4d: /* STEST1 */
1514 return s->stest1;
1515 case 0x4e: /* STEST2 */
1516 return s->stest2;
1517 case 0x4f: /* STEST3 */
1518 return s->stest3;
1519 case 0x50: /* SIDL */
1520 /* This is needed by the linux drivers. We currently only update it
1521 during the MSG IN phase. */
1522 return s->sidl;
1523 case 0x52: /* STEST4 */
1524 return 0xe0;
1525 case 0x56: /* CCNTL0 */
1526 return s->ccntl0;
1527 case 0x57: /* CCNTL1 */
1528 return s->ccntl1;
1529 case 0x58: /* SBDL */
1530 /* Some drivers peek at the data bus during the MSG IN phase. */
1531 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1532 return s->msg[0];
1533 return 0;
1534 case 0x59: /* SBDL high */
1535 return 0;
1536 CASE_GET_REG32(mmrs, 0xa0)
1537 CASE_GET_REG32(mmws, 0xa4)
1538 CASE_GET_REG32(sfs, 0xa8)
1539 CASE_GET_REG32(drs, 0xac)
1540 CASE_GET_REG32(sbms, 0xb0)
1541 CASE_GET_REG32(dbms, 0xb4)
1542 CASE_GET_REG32(dnad64, 0xb8)
1543 CASE_GET_REG32(pmjad1, 0xc0)
1544 CASE_GET_REG32(pmjad2, 0xc4)
1545 CASE_GET_REG32(rbc, 0xc8)
1546 CASE_GET_REG32(ua, 0xcc)
1547 CASE_GET_REG32(ia, 0xd4)
1548 CASE_GET_REG32(sbc, 0xd8)
1549 CASE_GET_REG32(csbc, 0xdc)
1550 }
1551 if (offset >= 0x5c && offset < 0xa0) {
1552 int n;
1553 int shift;
1554 n = (offset - 0x58) >> 2;
1555 shift = (offset & 3) * 8;
1556 return (s->scratch[n] >> shift) & 0xff;
1557 }
1558 BADF("readb 0x%x\n", offset);
1559 exit(1);
1560 #undef CASE_GET_REG24
1561 #undef CASE_GET_REG32
1562 }
1563
1564 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1565 {
1566 #define CASE_SET_REG24(name, addr) \
1567 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1568 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1569 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1570
1571 #define CASE_SET_REG32(name, addr) \
1572 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1573 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1574 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1575 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1576
1577 #ifdef DEBUG_LSI_REG
1578 DPRINTF("Write reg %x = %02x\n", offset, val);
1579 #endif
1580 switch (offset) {
1581 case 0x00: /* SCNTL0 */
1582 s->scntl0 = val;
1583 if (val & LSI_SCNTL0_START) {
1584 BADF("Start sequence not implemented\n");
1585 }
1586 break;
1587 case 0x01: /* SCNTL1 */
1588 s->scntl1 = val & ~LSI_SCNTL1_SST;
1589 if (val & LSI_SCNTL1_IARB) {
1590 BADF("Immediate Arbritration not implemented\n");
1591 }
1592 if (val & LSI_SCNTL1_RST) {
1593 s->sstat0 |= LSI_SSTAT0_RST;
1594 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1595 } else {
1596 s->sstat0 &= ~LSI_SSTAT0_RST;
1597 }
1598 break;
1599 case 0x02: /* SCNTL2 */
1600 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1601 s->scntl2 = val;
1602 break;
1603 case 0x03: /* SCNTL3 */
1604 s->scntl3 = val;
1605 break;
1606 case 0x04: /* SCID */
1607 s->scid = val;
1608 break;
1609 case 0x05: /* SXFER */
1610 s->sxfer = val;
1611 break;
1612 case 0x06: /* SDID */
1613 if ((val & 0xf) != (s->ssid & 0xf))
1614 BADF("Destination ID does not match SSID\n");
1615 s->sdid = val & 0xf;
1616 break;
1617 case 0x07: /* GPREG0 */
1618 break;
1619 case 0x08: /* SFBR */
1620 /* The CPU is not allowed to write to this register. However the
1621 SCRIPTS register move instructions are. */
1622 s->sfbr = val;
1623 break;
1624 case 0x0a: case 0x0b:
1625 /* Openserver writes to these readonly registers on startup */
1626 return;
1627 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1628 /* Linux writes to these readonly registers on startup. */
1629 return;
1630 CASE_SET_REG32(dsa, 0x10)
1631 case 0x14: /* ISTAT0 */
1632 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1633 if (val & LSI_ISTAT0_ABRT) {
1634 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1635 }
1636 if (val & LSI_ISTAT0_INTF) {
1637 s->istat0 &= ~LSI_ISTAT0_INTF;
1638 lsi_update_irq(s);
1639 }
1640 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1641 DPRINTF("Woken by SIGP\n");
1642 s->waiting = 0;
1643 s->dsp = s->dnad;
1644 lsi_execute_script(s);
1645 }
1646 if (val & LSI_ISTAT0_SRST) {
1647 lsi_soft_reset(s);
1648 }
1649 break;
1650 case 0x16: /* MBOX0 */
1651 s->mbox0 = val;
1652 break;
1653 case 0x17: /* MBOX1 */
1654 s->mbox1 = val;
1655 break;
1656 case 0x1a: /* CTEST2 */
1657 s->ctest2 = val & LSI_CTEST2_PCICIE;
1658 break;
1659 case 0x1b: /* CTEST3 */
1660 s->ctest3 = val & 0x0f;
1661 break;
1662 CASE_SET_REG32(temp, 0x1c)
1663 case 0x21: /* CTEST4 */
1664 if (val & 7) {
1665 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1666 }
1667 s->ctest4 = val;
1668 break;
1669 case 0x22: /* CTEST5 */
1670 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1671 BADF("CTEST5 DMA increment not implemented\n");
1672 }
1673 s->ctest5 = val;
1674 break;
1675 CASE_SET_REG24(dbc, 0x24)
1676 CASE_SET_REG32(dnad, 0x28)
1677 case 0x2c: /* DSP[0:7] */
1678 s->dsp &= 0xffffff00;
1679 s->dsp |= val;
1680 break;
1681 case 0x2d: /* DSP[8:15] */
1682 s->dsp &= 0xffff00ff;
1683 s->dsp |= val << 8;
1684 break;
1685 case 0x2e: /* DSP[16:23] */
1686 s->dsp &= 0xff00ffff;
1687 s->dsp |= val << 16;
1688 break;
1689 case 0x2f: /* DSP[24:31] */
1690 s->dsp &= 0x00ffffff;
1691 s->dsp |= val << 24;
1692 if ((s->dmode & LSI_DMODE_MAN) == 0
1693 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1694 lsi_execute_script(s);
1695 break;
1696 CASE_SET_REG32(dsps, 0x30)
1697 CASE_SET_REG32(scratch[0], 0x34)
1698 case 0x38: /* DMODE */
1699 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1700 BADF("IO mappings not implemented\n");
1701 }
1702 s->dmode = val;
1703 break;
1704 case 0x39: /* DIEN */
1705 s->dien = val;
1706 lsi_update_irq(s);
1707 break;
1708 case 0x3a: /* SBR */
1709 s->sbr = val;
1710 break;
1711 case 0x3b: /* DCNTL */
1712 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1713 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1714 lsi_execute_script(s);
1715 break;
1716 case 0x40: /* SIEN0 */
1717 s->sien0 = val;
1718 lsi_update_irq(s);
1719 break;
1720 case 0x41: /* SIEN1 */
1721 s->sien1 = val;
1722 lsi_update_irq(s);
1723 break;
1724 case 0x47: /* GPCNTL0 */
1725 break;
1726 case 0x48: /* STIME0 */
1727 s->stime0 = val;
1728 break;
1729 case 0x49: /* STIME1 */
1730 if (val & 0xf) {
1731 DPRINTF("General purpose timer not implemented\n");
1732 /* ??? Raising the interrupt immediately seems to be sufficient
1733 to keep the FreeBSD driver happy. */
1734 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1735 }
1736 break;
1737 case 0x4a: /* RESPID0 */
1738 s->respid0 = val;
1739 break;
1740 case 0x4b: /* RESPID1 */
1741 s->respid1 = val;
1742 break;
1743 case 0x4d: /* STEST1 */
1744 s->stest1 = val;
1745 break;
1746 case 0x4e: /* STEST2 */
1747 if (val & 1) {
1748 BADF("Low level mode not implemented\n");
1749 }
1750 s->stest2 = val;
1751 break;
1752 case 0x4f: /* STEST3 */
1753 if (val & 0x41) {
1754 BADF("SCSI FIFO test mode not implemented\n");
1755 }
1756 s->stest3 = val;
1757 break;
1758 case 0x56: /* CCNTL0 */
1759 s->ccntl0 = val;
1760 break;
1761 case 0x57: /* CCNTL1 */
1762 s->ccntl1 = val;
1763 break;
1764 CASE_SET_REG32(mmrs, 0xa0)
1765 CASE_SET_REG32(mmws, 0xa4)
1766 CASE_SET_REG32(sfs, 0xa8)
1767 CASE_SET_REG32(drs, 0xac)
1768 CASE_SET_REG32(sbms, 0xb0)
1769 CASE_SET_REG32(dbms, 0xb4)
1770 CASE_SET_REG32(dnad64, 0xb8)
1771 CASE_SET_REG32(pmjad1, 0xc0)
1772 CASE_SET_REG32(pmjad2, 0xc4)
1773 CASE_SET_REG32(rbc, 0xc8)
1774 CASE_SET_REG32(ua, 0xcc)
1775 CASE_SET_REG32(ia, 0xd4)
1776 CASE_SET_REG32(sbc, 0xd8)
1777 CASE_SET_REG32(csbc, 0xdc)
1778 default:
1779 if (offset >= 0x5c && offset < 0xa0) {
1780 int n;
1781 int shift;
1782 n = (offset - 0x58) >> 2;
1783 shift = (offset & 3) * 8;
1784 s->scratch[n] &= ~(0xff << shift);
1785 s->scratch[n] |= (val & 0xff) << shift;
1786 } else {
1787 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1788 }
1789 }
1790 #undef CASE_SET_REG24
1791 #undef CASE_SET_REG32
1792 }
1793
1794 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1795 {
1796 LSIState *s = opaque;
1797
1798 lsi_reg_writeb(s, addr & 0xff, val);
1799 }
1800
1801 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1802 {
1803 LSIState *s = opaque;
1804
1805 addr &= 0xff;
1806 lsi_reg_writeb(s, addr, val & 0xff);
1807 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1808 }
1809
1810 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1811 {
1812 LSIState *s = opaque;
1813
1814 addr &= 0xff;
1815 lsi_reg_writeb(s, addr, val & 0xff);
1816 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1817 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1818 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1819 }
1820
1821 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1822 {
1823 LSIState *s = opaque;
1824
1825 return lsi_reg_readb(s, addr & 0xff);
1826 }
1827
1828 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1829 {
1830 LSIState *s = opaque;
1831 uint32_t val;
1832
1833 addr &= 0xff;
1834 val = lsi_reg_readb(s, addr);
1835 val |= lsi_reg_readb(s, addr + 1) << 8;
1836 return val;
1837 }
1838
1839 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1840 {
1841 LSIState *s = opaque;
1842 uint32_t val;
1843 addr &= 0xff;
1844 val = lsi_reg_readb(s, addr);
1845 val |= lsi_reg_readb(s, addr + 1) << 8;
1846 val |= lsi_reg_readb(s, addr + 2) << 16;
1847 val |= lsi_reg_readb(s, addr + 3) << 24;
1848 return val;
1849 }
1850
1851 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1852 lsi_mmio_readb,
1853 lsi_mmio_readw,
1854 lsi_mmio_readl,
1855 };
1856
1857 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1858 lsi_mmio_writeb,
1859 lsi_mmio_writew,
1860 lsi_mmio_writel,
1861 };
1862
1863 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1864 {
1865 LSIState *s = opaque;
1866 uint32_t newval;
1867 int shift;
1868
1869 addr &= 0x1fff;
1870 newval = s->script_ram[addr >> 2];
1871 shift = (addr & 3) * 8;
1872 newval &= ~(0xff << shift);
1873 newval |= val << shift;
1874 s->script_ram[addr >> 2] = newval;
1875 }
1876
1877 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1878 {
1879 LSIState *s = opaque;
1880 uint32_t newval;
1881
1882 addr &= 0x1fff;
1883 newval = s->script_ram[addr >> 2];
1884 if (addr & 2) {
1885 newval = (newval & 0xffff) | (val << 16);
1886 } else {
1887 newval = (newval & 0xffff0000) | val;
1888 }
1889 s->script_ram[addr >> 2] = newval;
1890 }
1891
1892
1893 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1894 {
1895 LSIState *s = opaque;
1896
1897 addr &= 0x1fff;
1898 s->script_ram[addr >> 2] = val;
1899 }
1900
1901 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1902 {
1903 LSIState *s = opaque;
1904 uint32_t val;
1905
1906 addr &= 0x1fff;
1907 val = s->script_ram[addr >> 2];
1908 val >>= (addr & 3) * 8;
1909 return val & 0xff;
1910 }
1911
1912 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1913 {
1914 LSIState *s = opaque;
1915 uint32_t val;
1916
1917 addr &= 0x1fff;
1918 val = s->script_ram[addr >> 2];
1919 if (addr & 2)
1920 val >>= 16;
1921 return le16_to_cpu(val);
1922 }
1923
1924 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1925 {
1926 LSIState *s = opaque;
1927
1928 addr &= 0x1fff;
1929 return le32_to_cpu(s->script_ram[addr >> 2]);
1930 }
1931
1932 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1933 lsi_ram_readb,
1934 lsi_ram_readw,
1935 lsi_ram_readl,
1936 };
1937
1938 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1939 lsi_ram_writeb,
1940 lsi_ram_writew,
1941 lsi_ram_writel,
1942 };
1943
1944 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1945 {
1946 LSIState *s = opaque;
1947 return lsi_reg_readb(s, addr & 0xff);
1948 }
1949
1950 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1951 {
1952 LSIState *s = opaque;
1953 uint32_t val;
1954 addr &= 0xff;
1955 val = lsi_reg_readb(s, addr);
1956 val |= lsi_reg_readb(s, addr + 1) << 8;
1957 return val;
1958 }
1959
1960 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1961 {
1962 LSIState *s = opaque;
1963 uint32_t val;
1964 addr &= 0xff;
1965 val = lsi_reg_readb(s, addr);
1966 val |= lsi_reg_readb(s, addr + 1) << 8;
1967 val |= lsi_reg_readb(s, addr + 2) << 16;
1968 val |= lsi_reg_readb(s, addr + 3) << 24;
1969 return val;
1970 }
1971
1972 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1973 {
1974 LSIState *s = opaque;
1975 lsi_reg_writeb(s, addr & 0xff, val);
1976 }
1977
1978 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1979 {
1980 LSIState *s = opaque;
1981 addr &= 0xff;
1982 lsi_reg_writeb(s, addr, val & 0xff);
1983 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1984 }
1985
1986 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1987 {
1988 LSIState *s = opaque;
1989 addr &= 0xff;
1990 lsi_reg_writeb(s, addr, val & 0xff);
1991 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1992 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1993 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1994 }
1995
1996 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1997 pcibus_t addr, pcibus_t size, int type)
1998 {
1999 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2000
2001 DPRINTF("Mapping IO at %08"FMT_PCIBUS"\n", addr);
2002
2003 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
2004 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
2005 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
2006 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
2007 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
2008 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
2009 }
2010
2011 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
2012 pcibus_t addr, pcibus_t size, int type)
2013 {
2014 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2015
2016 DPRINTF("Mapping ram at %08"FMT_PCIBUS"\n", addr);
2017 s->script_ram_base = addr;
2018 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
2019 }
2020
2021 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
2022 pcibus_t addr, pcibus_t size, int type)
2023 {
2024 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2025
2026 DPRINTF("Mapping registers at %08"FMT_PCIBUS"\n", addr);
2027 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
2028 }
2029
2030 static void lsi_scsi_reset(DeviceState *dev)
2031 {
2032 LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
2033
2034 lsi_soft_reset(s);
2035 }
2036
2037 static void lsi_pre_save(void *opaque)
2038 {
2039 LSIState *s = opaque;
2040
2041 if (s->current) {
2042 assert(s->current->dma_buf == NULL);
2043 assert(s->current->dma_len == 0);
2044 }
2045 assert(QTAILQ_EMPTY(&s->queue));
2046 }
2047
2048 static const VMStateDescription vmstate_lsi_scsi = {
2049 .name = "lsiscsi",
2050 .version_id = 0,
2051 .minimum_version_id = 0,
2052 .minimum_version_id_old = 0,
2053 .pre_save = lsi_pre_save,
2054 .fields = (VMStateField []) {
2055 VMSTATE_PCI_DEVICE(dev, LSIState),
2056
2057 VMSTATE_INT32(carry, LSIState),
2058 VMSTATE_INT32(sense, LSIState),
2059 VMSTATE_INT32(msg_action, LSIState),
2060 VMSTATE_INT32(msg_len, LSIState),
2061 VMSTATE_BUFFER(msg, LSIState),
2062 VMSTATE_INT32(waiting, LSIState),
2063
2064 VMSTATE_UINT32(dsa, LSIState),
2065 VMSTATE_UINT32(temp, LSIState),
2066 VMSTATE_UINT32(dnad, LSIState),
2067 VMSTATE_UINT32(dbc, LSIState),
2068 VMSTATE_UINT8(istat0, LSIState),
2069 VMSTATE_UINT8(istat1, LSIState),
2070 VMSTATE_UINT8(dcmd, LSIState),
2071 VMSTATE_UINT8(dstat, LSIState),
2072 VMSTATE_UINT8(dien, LSIState),
2073 VMSTATE_UINT8(sist0, LSIState),
2074 VMSTATE_UINT8(sist1, LSIState),
2075 VMSTATE_UINT8(sien0, LSIState),
2076 VMSTATE_UINT8(sien1, LSIState),
2077 VMSTATE_UINT8(mbox0, LSIState),
2078 VMSTATE_UINT8(mbox1, LSIState),
2079 VMSTATE_UINT8(dfifo, LSIState),
2080 VMSTATE_UINT8(ctest2, LSIState),
2081 VMSTATE_UINT8(ctest3, LSIState),
2082 VMSTATE_UINT8(ctest4, LSIState),
2083 VMSTATE_UINT8(ctest5, LSIState),
2084 VMSTATE_UINT8(ccntl0, LSIState),
2085 VMSTATE_UINT8(ccntl1, LSIState),
2086 VMSTATE_UINT32(dsp, LSIState),
2087 VMSTATE_UINT32(dsps, LSIState),
2088 VMSTATE_UINT8(dmode, LSIState),
2089 VMSTATE_UINT8(dcntl, LSIState),
2090 VMSTATE_UINT8(scntl0, LSIState),
2091 VMSTATE_UINT8(scntl1, LSIState),
2092 VMSTATE_UINT8(scntl2, LSIState),
2093 VMSTATE_UINT8(scntl3, LSIState),
2094 VMSTATE_UINT8(sstat0, LSIState),
2095 VMSTATE_UINT8(sstat1, LSIState),
2096 VMSTATE_UINT8(scid, LSIState),
2097 VMSTATE_UINT8(sxfer, LSIState),
2098 VMSTATE_UINT8(socl, LSIState),
2099 VMSTATE_UINT8(sdid, LSIState),
2100 VMSTATE_UINT8(ssid, LSIState),
2101 VMSTATE_UINT8(sfbr, LSIState),
2102 VMSTATE_UINT8(stest1, LSIState),
2103 VMSTATE_UINT8(stest2, LSIState),
2104 VMSTATE_UINT8(stest3, LSIState),
2105 VMSTATE_UINT8(sidl, LSIState),
2106 VMSTATE_UINT8(stime0, LSIState),
2107 VMSTATE_UINT8(respid0, LSIState),
2108 VMSTATE_UINT8(respid1, LSIState),
2109 VMSTATE_UINT32(mmrs, LSIState),
2110 VMSTATE_UINT32(mmws, LSIState),
2111 VMSTATE_UINT32(sfs, LSIState),
2112 VMSTATE_UINT32(drs, LSIState),
2113 VMSTATE_UINT32(sbms, LSIState),
2114 VMSTATE_UINT32(dbms, LSIState),
2115 VMSTATE_UINT32(dnad64, LSIState),
2116 VMSTATE_UINT32(pmjad1, LSIState),
2117 VMSTATE_UINT32(pmjad2, LSIState),
2118 VMSTATE_UINT32(rbc, LSIState),
2119 VMSTATE_UINT32(ua, LSIState),
2120 VMSTATE_UINT32(ia, LSIState),
2121 VMSTATE_UINT32(sbc, LSIState),
2122 VMSTATE_UINT32(csbc, LSIState),
2123 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2124 VMSTATE_UINT8(sbr, LSIState),
2125
2126 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2127 VMSTATE_END_OF_LIST()
2128 }
2129 };
2130
2131 static int lsi_scsi_uninit(PCIDevice *d)
2132 {
2133 LSIState *s = DO_UPCAST(LSIState, dev, d);
2134
2135 cpu_unregister_io_memory(s->mmio_io_addr);
2136 cpu_unregister_io_memory(s->ram_io_addr);
2137
2138 return 0;
2139 }
2140
2141 static int lsi_scsi_init(PCIDevice *dev)
2142 {
2143 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2144 uint8_t *pci_conf;
2145
2146 pci_conf = s->dev.config;
2147
2148 /* PCI Vendor ID (word) */
2149 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2150 /* PCI device ID (word) */
2151 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2152 /* PCI base class code */
2153 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2154 /* PCI subsystem ID */
2155 pci_conf[PCI_SUBSYSTEM_ID] = 0x00;
2156 pci_conf[PCI_SUBSYSTEM_ID + 1] = 0x10;
2157 /* PCI latency timer = 255 */
2158 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2159 /* TODO: RST# value should be 0 */
2160 /* Interrupt pin 1 */
2161 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2162
2163 s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2164 lsi_mmio_writefn, s);
2165 s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2166 lsi_ram_writefn, s);
2167
2168 /* TODO: use dev and get rid of cast below */
2169 pci_register_bar((struct PCIDevice *)s, 0, 256,
2170 PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2171 pci_register_bar((struct PCIDevice *)s, 1, 0x400,
2172 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
2173 pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
2174 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2175 QTAILQ_INIT(&s->queue);
2176
2177 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2178 if (!dev->qdev.hotplugged) {
2179 return scsi_bus_legacy_handle_cmdline(&s->bus);
2180 }
2181 return 0;
2182 }
2183
2184 static PCIDeviceInfo lsi_info = {
2185 .qdev.name = "lsi53c895a",
2186 .qdev.alias = "lsi",
2187 .qdev.size = sizeof(LSIState),
2188 .qdev.reset = lsi_scsi_reset,
2189 .qdev.vmsd = &vmstate_lsi_scsi,
2190 .init = lsi_scsi_init,
2191 .exit = lsi_scsi_uninit,
2192 };
2193
2194 static void lsi53c895a_register_devices(void)
2195 {
2196 pci_qdev_register(&lsi_info);
2197 }
2198
2199 device_init(lsi53c895a_register_devices);
QEmu